Chart gaps between IP ID

edit

Please be very careful when using ip.id as an indicator for packet loss. Not all systems use the same algorithm to create ip.id numbers. I (think I) have seen the following patterns over time:

• one counter for the whole system. IE when other processes are also sending data, then you will have gaps in the ip.id numbers for your specific UDP stream
• one counter per process. In this case your method will work, but are you sure this method is used by all systems that you want to track?
• random ip.id numbers. Your method will not work here obviously, do you have control over the sending side so you can be sure this method is not used?
• 0x0000 for all packets. Your method will not work here obviously, do you have control over the sending side so you can be sure this method is not used?

Are you sure there is not a sequence number used in the payload of the UDP packets? If there is, you might want to write a Lua dissector for this protocol in which you expose the found sequence number to wireshark to filter on. And you can add some logic to determine if there are gaps and/or out-of-order udp packets.

No, not really.

You can do this task by different ways. 2 of them I show you.

You can use tshark -> Have a detailed look here https://www.youtube.com/watch?v=gMg8t...

You can use the "File -> Export Packet dissections -> As CSV..." dialog to export the packet pane view to a csv file. After that you can import it into excel and do some sorts or scripting around it....