Hello, I'm trying to analyze----follow----udp stream a pcap file in order to check the payload but the output of the follow UDP stream is quite unreadable. I'm trying to check if any mising sequence numbers. any ideas on how to make that output more human readable?
thanks in advance for your help cheers
Hello, I'm trying to analyze----follow----udp stream a pcap file in order to check the payload but the output of the follow UDP stream is quite unreadable.
"Follow UDP Stream" was inspired by "Follow TCP Stream"; they both are oriented towards protocols using plain text. Many protocols that run over TCP are plain-text; not as many protocols that run over UDP are plain-text.
I'm trying to check if any mising sequence numbers
UDP has no sequence numbers - each UDP datagram is on its own.
The only sequence numbers you will see are sequence numbers in protocols running above UDP; Wireshark may be able to dissect some of those protocols. What protocol are you trying to analyze?
Hello, thanks for the quick response, unfortunately I don´t have visibility above the transport layer, my customer is reporting gaps on this market data stream and from a network perspective I could not see packet drops nor interface errors on the network devices throughout the path, that's why we decided to port mirror the demarcation point. I understand that UDP is connectionless, correct me if I'm wrong but I believe that checking inside the payload we could find correlative numbers and see if some are missing. Thing is that I'm not quite sure how to do that.
cheers and thanks again
correct me if I'm wrong but I believe that checking inside the payload we could find correlative numbers and see if some are missing
That depends on the protocol. Ask the customer what the protocol is; if Wireshark can dissect it, that might let you see what sequence information that protocol has.
"market data stream" - surprised this stuff isn't encrypted (yes some latency but FPGAs/ASICs .....)
Everything from products to open source Wireshark Lua plugins
Hi, you may try certain application-layer methods to solve your problem, such as using some bytes of the payload to store a header with a sequence number.
For example, I am using NS3 to do some simulations. In my case, the ns3::OnOffApplication Class has an attribute called "EnableSeqTsSizeHeader". If the attribute "EnableSeqTsSizeHeader" is enabled, the application will use some bytes of the payload to store a header with a sequence number, a timestamp, and the size of the packet sent.
Asked: 2020-09-21 21:46:06 +0000
Seen: 2,898 times
Last updated: Sep 22 '20
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
