https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3455
Sake <sake@xxxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |INVALID
--- Comment #2 from Sake <sake@xxxxxxxxxx> 2009-05-18 14:44:46 PDT ---
This is a side effect of using relative sequence numbers when the three-way
handshake is not captured. Since Wireshark does not know the ISN (Initial
Sequence Number) of both flows, it will initiate its counters based on the
first seen packet. Then when a frame that was sent before the first seen packet
is acknowledged, it will result in a negative value. But since the value is of
an unsigned type, it is displayed as a very high value.
If you turn off relative sequence numbers, you will see the real seq and ack
that are present in the trace and can do the analysis from there.
Closing this bug...
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
