Ask Your Question

Does wireshark or can wireshark reassemble packets with TCP Out-of-Order warnings?

asked 2019-02-04 07:39:42 +0000

isaac1578 gravatar image

A sample pcapng file I have have several "TCP Out-of-Order", "TCP Retransmission", "TCP Fast Retransmission", etc. Using the Analyze -> Follow TCP Stream feature of wireshark, the payload can be reassembled successfully. So, does wireshark have a built-in feature that can be enabled to reassemble the packets and display the reassembled packets in the Packet List and Packet Details pane instead of using the Follow TCP Stream feature? If not, how can this be implemented, where do I start? Any suggestion is very much appreciated.

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted

answered 2019-02-04 20:40:59 +0000

Jasper gravatar image

Wireshark can reassemble packets and does it, too, as long as the TCP setting "Allow Subdissectors to reassemble TCP streams" is enabled. You can tell by e.g. looking at the last packet of a HTTP response which will list all segments that are part of the answer in an additional section in the decode pane.

I assume you want Wireshark to reorder packets in the packet list though - this is not reassembly and can't be done. The packet list always shows the order of packets arriving at the time of the capture (assuming it's sorted by "No." column). You can't force it to reorder the packets according to sequence numbers.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-02-04 07:39:42 +0000

Seen: 590 times

Last updated: Feb 04 '19