Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Out of sequence packets

From: Martin Visser <martinvisser99@xxxxxxxxx>
Date: Sun, 26 Apr 2009 22:13:30 +1000
I'm not sure why you want to reorder the packets. Wireshark is showing
you the packets as the network (and presumably your client) sees them.
As long as a packet out of order can be properly handled by the
receiver then there isn't an issue. TCP for instance is designed to
cope with this. And if an out of order segment is very delayed, then
the TCP will resend the missing segment in any case.

Some of the dissected protocols for instance HTTP also allow you to
have visibility of the whole object, as long it is complete, even if
it is made up of out of order or duplicate packets.

If your protocol isn't handling out of order packets, then the problem
is with the protocol and not wireshark.


Regards, Martin

MartinVisser99@xxxxxxxxx



On Sun, Apr 26, 2009 at 7:50 PM, Matthieu Patou
<mat+Informatique.Wireshark@xxxxxxxxx> wrote:
> Hello,
>
> I captured packets that goes through an MPLS network. As a result of
> this I got time to times out of order packets, this is very anoying when
> the load do not fit in one packet because wireshark is not able to
> reorder packets (ie. if you have sequence 1341 before sequence 1 then
> you're caught).
>
> Is there a way to reorder the packets ? (option to editcap for instance
> ...).
>
> Thanks for your help.
>
> Matthieu
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>