Wireshark-dev: Re: [Wireshark-dev] Wireshark's ISN handling
From: ronnie sahlberg <[email protected]>
Date: Mon, 17 Aug 2009 17:59:43 +1000
It does happen from time to time.

Most commonly when you have a retransmitted packet early in the trace
that has a sequence number "before" the first packet seen.
In that case those retransmitted packets just get a negative sequence
number (~ -2 billion something).

You get used to it and it is not really much of a big deal.

On Mon, Aug 17, 2009 at 5:45 PM, Selçuk Cevher<[email protected]> wrote:
> Hi,
> I made some tests with Wireshark using some sample PCAP files.
> I noticed that Wireshark stores the sequence number of the first segment
> belonging to a specific connection that it comes across in the PCAP file as
> the ISN (initial sequence number) of that connection.
> I always thought that there might be a possibility that the first segment of
> a TCP stream (with the sequence number of ISN+1) may appear "after", for
> example, 2nd segment of a certain TCP connection.
> Was this thought totally wrong that we never come across such a case ? or
> Does Wireshark not handle such a case which may actually occur in practice ?
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <[email protected]>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>             mailto:[email protected]?subject=unsubscribe