Wireshark · Ethereal-users: [Ethereal-users] RE: Question on using TCP Stream Graph/ Time-Sequence Graph.

[Stoiber Robert-RSTOIBE1 <Robert.Stoiber@xxxxxxxxxxxx>]

Title: Message

 

sometimes the sequence number is odd and doesn't fit into the tcp-session. the numbers look much too high.

 

if u lock the y-axis (sequence number) and zoom in u'll see the chart standing up and the expected chart appears. give it a try... or u could cut off the packets with the higher sequence number from the file and draw the chart from the new tcp-session.

 

i've seen packets with "much too high" sequence number for instance in case of tcp-reset commands.

 

cheers,

robert

-----Original Message-----
From: Cho David-qsg0070
Sent: Donnerstag, 02. September 2004 11:59
To: ethereal-users@xxxxxxxxxxxx
Cc: Rifa (Abdul Latif Rifayudeen-QSG4019); Myself (David Cho Kah Loong); Robert Stoiber (Stoiber Robert-RSTOIBE1 [Robert_Stoiber-RSTOIBE1@xxxxxxxxxxxxx])
Subject: Question on using TCP Stream Graph/ Time-Sequence Graph.

i sometimes use the abovementioned to look at FTP sessions to see if the TCP layer is performing ok. When i select a packet and try and activate the tcptrace type graph, sometimes, it doesnt work.  By this, i mean that i get a very weird looking tcptrace graph, that doesnt make sense at all.  its all straight lines, step changes, totally weird.   Then i select other packets from other ftp sessions and i can see the proper tcptrace.

 

can someone tell me what conditions need be fulfilled in order for me to see the tcptrace graph ? why can i see the tcptrace for some packets and not for others ?

 

thanks alot,

 

david.