Wireshark-bugs: [Wireshark-bugs] [Bug 3455] Huge ack number found when capture.
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 18 May 2009 14:44:47 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3455


Sake <sake@xxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID




--- Comment #2 from Sake <sake@xxxxxxxxxx>  2009-05-18 14:44:46 PDT ---
This is a side effect of using relative sequence numbers when the three-way
handshake is not captured. Since Wireshark does not know the ISN (Initial
Sequence Number) of both flows, it will initiate its counters based on the
first seen packet. Then when a frame that was sent before the first seen packet
is acknowledged, it will result in a negative value. But since the value is of
an unsigned type, it is displayed as a very high value.

If you turn off relative sequence numbers, you will see the real seq and ack
that are present in the trace and can do the analysis from there.

Closing this bug...


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.