Does wireshark or can wireshark reassemble packets with TCP Out-of-Order warnings?

asked 2019-02-04 07:39:42 +0000

isaac1578
1 ●1 ●1 ●1

A sample pcapng file I have have several "TCP Out-of-Order", "TCP Retransmission", "TCP Fast Retransmission", etc. Using the Analyze -> Follow TCP Stream feature of wireshark, the payload can be reassembled successfully. So, does wireshark have a built-in feature that can be enabled to reassemble the packets and display the reassembled packets in the Packet List and Packet Details pane instead of using the Follow TCP Stream feature? If not, how can this be implemented, where do I start? Any suggestion is very much appreciated.

answered 2019-02-04 20:40:59 +0000

Jasper
24103 ●5 ●111 ●292 Düsseldorf, Germany

Wireshark can reassemble packets and does it, too, as long as the TCP setting "Allow Subdissectors to reassemble TCP streams" is enabled. You can tell by e.g. looking at the last packet of a HTTP response which will list all segments that are part of the answer in an additional section in the decode pane.

I assume you want Wireshark to reorder packets in the packet list though - this is not reassembly and can't be done. The packet list always shows the order of packets arriving at the time of the capture (assuming it's sorted by "No." column). You can't force it to reorder the packets according to sequence numbers.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Does wireshark or can wireshark reassemble packets with TCP Out-of-Order warnings?

1 Answer

Your Answer

Question Tools

Stats

Does wireshark or can wireshark reassemble packets with TCP Out-of-Order warnings? edit

1 Answer

Your Answer

Question Tools

Stats

Does wireshark or can wireshark reassemble packets with TCP Out-of-Order warnings?