how to understand out-of-order TCP segments?

Question

Hi, I would like to know the meaning of out-of-order TCP segments in wireshark with the following question

What would make wireshark mark a segment as out-of-order?
IP layer should re-order IP packets correctly and then give them to TCP, why could out-of-order occur?
Does out-of-order always mean bad things?
What should we do when we see out-of-order TCP segments, especially when there are lots of them.

thank you!

Accepted Answer

The SEQ number is not what Wireshark would have expected as next SEQ number (see below)
Different devices on the way my handle IP packets differently, and thus forwarding one frame earlier/later than another. Or different IP frames take different routes (rather seldom).
No, if it's not too many of them
Figure out what causes them. Capture at the sender and the receiver side and compare the capture files. If that does not help, move along the path and take captures at different places (if possible - obviously a problem if the data path 'crosses' the internet). Make sure, the 'out-of-order' frames aren't just duplicated frames, by checking the IP ID (try to find duplicate IP IDs).

From packet-tcp.c:

       
       /* If the segment came <3ms since the segment with the highest
         * seen sequence number and it doesn't look like a retransmission
         * then it is an OUT-OF-ORDER segment.
         *   (3ms is an arbitrary number)
         */
    t=(pinfo-&gt;fd-&gt;abs_ts.secs-tcpd-&gt;fwd-&gt;nextseqtime.secs)*1000000000;
    t=t+(pinfo-&gt;fd-&gt;abs_ts.nsecs)-tcpd-&gt;fwd-&gt;nextseqtime.nsecs;
    if( t&lt;3000000
    &amp;&amp; tcpd-&gt;fwd-&gt;nextseq != seq + seglen ) {
        if(!tcpd-&gt;ta) {
            tcp_analyze_get_acked_struct(pinfo-&gt;fd-&gt;num, seq, ack, TRUE, tcpd);
        }
        tcpd-&gt;ta-&gt;flags|=TCP_A_OUT_OF_ORDER;
        goto finished_checking_retransmission_type;
    }</code></pre><p>BTW: See also other questions with the tag: out-of-order</p><blockquote><p><a href="http://ask.wireshark.org/tags/out-of-order/">http://ask.wireshark.org/tags/out-of-order/</a></p></blockquote><p>Basically the same explanation as I gave above, just different (real world) examples ;-))</p><p>Regards<br />

Kurt

Answer 2

A common reason why Wireshark marks certain segments "Out-of-order" is because of a known bug in Wireshark:

In a sequence like the following:

1) A ------SYN-----> B

2) A <-----SYN------ B

3) A ----SYN/ACK---> B

, Wireshark will mark segment 3) "Out-of-order".

This is of course a mistake. This sequence is a normal TCP sequence, often called "TCP simultaneous connect". Since P2P applications use TCP simultaneous connect a lot to perform TCP NAT punching, you might see such sequences and false positives often.

Someone at Wireshark should fix it imho, it looks bad when a network analyzer doesn't understand the basic TCP state diagram.