ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Wireshark may get ISN wrong

From: Matt <mattator@xxxxxxxxx>
Date: Mon, 17 Nov 2014 18:38:59 +0100
Hi,

I use wireshark to examinate some traces generated by a network
simulator (ns3 www.nsnam.org) which set the ISN to 0 (no randomization
yet).
As wireshark assumes base_seq == 0 to be an unitialized value, it
triggers some error as wireshark tries to set again and again the base
seq. Here is the output of a single 3WHS (custom printf), in peculiar
in the 4th line, which is the ACK of the 3WHS, wiresharks sets
base_seq =seq-1, ie 0-1 and it wraps the seq number (ugly).

Setting base seq to : 0
Setting base seq to : 0
Setting rev base seq to : 0
Setting base seq to : 4294967295
Setting rev base seq to : 0
Setting rev base seq to : 0
Setting base seq to : 0
Setting base seq to : 0
Setting rev base seq to : 0
Setting base seq to : 0
Setting rev base seq to : 0
Setting base seq to : 1

I understand it seems a corner case but I don't believe have an ISN
equal to 0 is forbidden by the RFC ?!
I was wondering if I could add some boolean such as "base_seq_set" in
mptcp_info_t to prevent such a behavior.

Regards
Matt