Ethereal-dev: [Ethereal-dev] TCP analysis and relative sequence numbers

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Ronnie Sahlberg" <sahlberg@xxxxxxxxxxxxxxxx>
Date: Sat, 3 Aug 2002 09:08:02 +1000
Hi list, Hi Joerg.

Joerg, I hope this patch does what you requested some two weeks ago.
It was a bit more work than I first planned and also with my wife breaking
her ankle
my spare time to hack has been significantly reduced. Sorry for the time it
took.
Please test it and tell me what other updates you think it might need.

---
I just checked in two new options to TCP.
  1, Analyze TCP sequence numbers.
     This option will keep track of sequence numbers for all tcp sessions
     and flag the following:
     a, If a new segment is seen which is beyong the right edge this is
        an indication that the previous segment was lost and this will be
        flagged as previous segment lost.
     b, If a segment is seen which lies left of the right edge this is
flagged
        as retransmission.
     c, if a keep-alive is seen (empty segment, seq==expected seq-1)
        this is flagged as a retransmission.
     d, if an ACK is seen which is beyond the right edge this is an
indication
        that a segment has been lost and it will be flagged as segment lost.

     All ACKs which advance the left edge get the RTT displayed between the
ACKed
     segment and the ACK itself. The ACK also gets an indication of WHICH
segment
     it is an ACK for.

  2, Relative sequence numbers. This option needs the first option to be
selected
  as well. This option will as best as it can try to get ethereal to use
  relative sequence numbers instead of absolute ones.

The patch does not work with wrapping sequence numbers but that should be so
rare that
I dont know if it would be worth the (semi-significant) effort to update it
to handle
that as well.
Well, if someone really really wants it to handle wrapping sequence numbers,
I can look into it.


I have tested it on some captures and it seems to work fine.
I would appreciate any feedback on problems and/or suggestions for
improvement on this patch.

best regards
    ronnie sahlberg