Does wireshark or can wireshark reassemble packets with TCP Out-of-Order warnings?

retag add tags

A sample pcapng file I have have several "TCP Out-of-Order", "TCP Retransmission", "TCP Fast Retransmission", etc. Using the Analyze -> Follow TCP Stream feature of wireshark, the payload can be reassembled successfully. So, does wireshark have a built-in feature that can be enabled to reassemble the packets and display the reassembled packets in the Packet List and Packet Details pane instead of using the Follow TCP Stream feature? If not, how can this be implemented, where do I start? Any suggestion is very much appreciated.

Wireshark can reassemble packets and does it, too, as long as the TCP setting "Allow Subdissectors to reassemble TCP streams" is enabled. You can tell by e.g. looking at the last packet of a HTTP response which will list all segments that are part of the answer in an additional section in the decode pane.

I assume you want Wireshark to reorder packets in the packet list though - this is not reassembly and can't be done. The packet list always shows the order of packets arriving at the time of the capture (assuming it's sorted by "No." column). You can't force it to reorder the packets according to sequence numbers.

24.1k

Jasper

answered 2019-02-04 20:40:59 +0000

edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Does wireshark or can wireshark reassemble packets with TCP Out-of-Order warnings? edit

Comments

1 Answer

Comments