Ethereal-dev: Re: [Ethereal-dev] TCP reassembly retransmission/overlap flags

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 22 Jul 2002 13:16:14 -0700
On Tue, Jul 23, 2002 at 05:38:56AM +1000, Ronnie Sahlberg wrote:
> It basically offers an option you can enable and which will remember state
> for each TCP conversation

That could also allow Ethereal to display relative sequence numbers for
TCP segments (that's what tcpdump does by default; the "-S" flag makes
it display the absolute sequence number that appears in the packet -
note that without "-S", tcpdump can run out of memory when dissecting,
say, a trace of an attack by somebody spewing SYNs, so there are reasons
why you might want to disable the option in Ethereal/Tethereal in some
cases).