7ACE's profile - activity

Thank you for the explanation.

v4.4.4 Wireshark crashes Hi experts, When using Wireshark to sort packets, the program crashes. Is this because the pro

Thanks to all for your help and patience.

Thanks for your answer. 4.2.7 still have the same problem.

v4.2.x TCP ACKed unseen segment Hi experts, For the TCP Analysis , Why isn't packet No.6 marked with "TCP ACKed unseen

v4.2.x TCP ACKed unseen segment Hi experts, For the TCP Analysis , Why isn't packet No.6 marked with "TCP ACKed unseen

Hi experts,

What is nextseq and nextseqtime? Is the nextseqtime an estimated value or a real value?

No.1 SeqNum 1      NextSeq 1449    Ack 100 
No.2 SeqNum 1449   NextSeq 2897    Ack 100

1. Is nextseq 2897?
2. Is nextseqtime the timestamp of packet No.2? or?


No.1 SeqNum 1      NextSeq 1449    Ack 100 
No.2 SeqNum 2897   NextSeq 3000    Ack 100

3. Is nextseq 3000?
4. Is nextseqtime the timestamp of packet No.2? or?

The relevant code:

 typedef struct tcp_analyze_seq_flow_info_t {
    guint32 nextseq;         /* highest seen nextseq */
    nstime_t nextseqtime;    /* Time of the nextseq packet so we can
                              * distinguish between retransmission,
                              * fast retransmissions and outoforder
                              */
 }

Regards, 7ACE

Hi experts,

For the TCP Analysis , I have the following questions :

https://www.wireshark.org/docs/wsug_h...

Next expected sequence number

The last-seen sequence number plus segment length. Set when there are no analysis flags and for zero window probes. This is initially zero and calculated based on the previous packet in the same TCP flow. Note that this may not be the same as the tcp.nxtseq protocol field.

1.What's the difference between "Next expected sequence number" and "Next sequence number"?

Next sequence number : tcp.nxtseq = tcp.seq + tcp.len

Next expected sequence number : ?

2.What's the meaning of the "Set when there are no analysis flags and for zero window probes." ?

3.What's the meaning of the "Note that this may not be the same as the tcp.nxtseq protocol field."?In what situation would this happen?

Next expected acknowledgement number

The last-seen sequence number for segments. Set when there are no analysis flags and for zero window probes.

4.Next expected acknowledgement number : tcp.ack ?

Last-seen acknowledgment number

Always set. Note that this is not the same as the next expected acknowledgment number.

Last-seen acknowledgment number

Always updated for each packet. Note that this is not the same as the next expected acknowledgment number.

5.What's the difference between the two?

Regards, 7ACE

So does nextseq refer to the NextSeqNum of the current packet, while tcpd->fwd->tcp_analyze_seq_info->nextseq r

nextseq and nextseqtime Hi experts, What is nextseq and nextseqtime? Is the nextseqtime an estimated value or a real va

nextseqtime Hi experts, What is nextseqtime? Is it an estimated value or a real value? No.1 SeqNum 1 NextSeq 1449

nextseqtime Hi experts, What is nextseqtime? Is it an estimated value or a real value? No.1 SeqNum 1 NextSeq 1449

Hi experts,

For the pcap, SYN、SYN/ACK、RST、SYN、SYN/ACK、RST, When I ignore the No.4 SYN packet,Why is packet No.2 marked with "TCP Port numbers reused"? tcpd == NULL?

No. Source       Destination  Protocol Stream Length Info
1   10.83.12.253 10.92.54.95  TCP        0    62     54321 > 447 [SYN] Seq=0 Win=14600 Len=0
2   10.92.54.95  10.83.12.253 TCP        0    60     [TCP Port numbers reused] 447  >  54321 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460
3   10.83.12.253 10.92.54.95  TCP        0    62     54321 > 447 [RST] Seq=1 Win=0 Len=0
4   <Ignored>
5   10.92.54.95  10.83.12.253 TCP        0    60     [TCP Previous segment not captured] [TCP Port numbers reused] 447  >  54321 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460
6   10.83.12.253 10.92.54.95  TCP        0    62     54321 > 447 [RST] Seq=1 Win=0 Len=0

The relevant code:

packet-tcp.c
SYN
if (tcpd != NULL  && (tcph->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) {
    ...
    tcpd->ta->flags|=TCP_A_REUSED_PORTS;
    ...
}

SYN/ACK
if (tcpd != NULL && (tcph->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)){
    ...
    tcpd->ta->flags|=TCP_A_REUSED_PORTS;
    ...
}

Regards, 7ACE

Thank you for the explanation.

Perhaps a switch in the network recognizes the lldp packet and so does not forward it.

TCP Port numbers reused Hi experts, For the pcap, SYN、SYN/ACK、RST、SYN、SYN/ACK、RST, When I ignore the No.4 SYN packet,Wh

TCP Port numbers reused Hi experts, For the pcap, SYN、SYN/ACK、RST、SYN、SYN/ACK、RST, When I ignore the No.4 SYN packet,Wh

I've found the answer.The value of maxseqtobeacked is 21.

GT_SEQ(ack, tcpd->rev->tcp_analyze_seq_info->maxseqtobeacked) Is the value of 'maxseqtobeacked' 15621, not 156

GT_SEQ(ack, tcpd->rev->tcp_analyze_seq_info->maxseqtobeacked) Is the value of 'maxseqtobeacked' 15621, not 156

ACKED LOST PACKET & Zero Window Probe Hi experts, For issue #8404 error.pcap,Is No.12 [TCP Window Update] determine

TCP ACKed unseen segment Hi experts, For the No.6 [TCP ACKed unseen segment], is the value of maxseqtobeacked 21? No.4

Thank you so much for the clear explanation!

Hi experts,

For the TCP Analysis, What is "tcpd->rev->is_first_ack"? In which scenarios will it be used?

/* WINDOW FULL
 * If we know the window scaling
 * and if this segment contains data and goes all the way to the
 * edge of the advertised window
 * then we mark it as WINDOW FULL
 * SYN/RST/FIN packets are never WINDOW FULL
 */
if( seglen>0
&&  tcpd->rev->win_scale!=-1
&&  (seq+seglen)==(tcpd->rev->tcp_analyze_seq_info->lastack+(tcpd->rev->window<<(tcpd->rev->is_first_ack?0:(tcpd->rev->win_scale==-2?0:tcpd->rev->win_scale))))
&&  (flags&(TH_SYN|TH_FIN|TH_RST))==0 ) {
    if(!tcpd->ta) {
        tcp_analyze_get_acked_struct(pinfo->num, seq, ack, TRUE, tcpd);
    }
    tcpd->ta->flags|=TCP_A_WINDOW_FULL;
}

Regards, 7ACE

tcpd->fwd？tcpd->rev?

https://gitlab.com/wireshark/wireshark/-/issues/14690 TcpWindowFull.pcap，Is No.68(SYN/ACK) the “tcpd->rev->is_fir

tcpd->rev->is_first_ack Hi experts, For the TCP Analysis, What is "tcpd->rev->is_first_ack"? In which scena

tcpd->rev->is_first_ack Hi experts, For the TCP Analysis, What is "tcpd->rev->is_first_ack"? In which sc

frame.time >= "Mar 1, 2023 16:22:00" && frame.time <= "Mar 1, 2023 16:24:00"