Ethereal-users: RE: [Ethereal-users] Packets out of Order

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Francisco Alcoba (ML/EEM)" <francisco.alcoba@xxxxxxxxxxxx>
Date: Tue, 14 Sep 2004 17:49:06 +0200
Hi,

> > > How Do I determine from a capture that packets are being 
> > > received out of order?

> > if your application protocol sits atop tcp, then ethereal 
> > will display
> > those packets as [TCP out-of-order].

> This is an h.323 video stream. My MCU is complaining of OOP 
> and I am just trying to validate this.

That means video is probably sent via RTP. If Ethereal knows it is RTP, it can look for sequence numbers in the stream packets. 

The fact that Ethereal knows or not whether the packets are RTP is a bit complex; you can see a summary in http://www.ethereal.com/faq.html#q5.32

Anyway, if you know -or suspect- that some packets that Ethereal shows as UDP are RTP, you can select one of them, go to Analyze -> Decode As and configure it to be decoded as such. After that you can see the sequence number in the decoded packet, and you can go to Analyze -> RTP -> Stream Analysis and you will get information on the sequence number and, in the Status column, you'll find a comment if the order is wrong.

If you are not using RTP, you still might be able to infer something from the Identification field in the IP header, which is not forced to be, but at least sometimes is, sequential -i.e. if you find 1234, 1235, 1236, 1238 and 1237 you can strongly suspect the last two have been reordered-.

Regards,

Francisco

> -----Original Message-----
> From: ethereal-users-bounces@xxxxxxxxxxxx
> [mailto:ethereal-users-bounces@xxxxxxxxxxxx]On Behalf Of
> stankinator@xxxxxxxxxxxxx
> Sent: martes, 14 de septiembre de 2004 14:50
> To: ronnie sahlberg; Ethereal user support
> Subject: Re: [Ethereal-users] Packets out of Order
> 
> 
> Thank.
> 
> This is an h.323 video stream. My MCU is complaining of OOP 
> and I am just trying to validate this.
> 
> Thanks
> 
> ----- Original Message -----
> From: ronnie sahlberg <ronniesahlberg@xxxxxxxxx>
> Date: Tuesday, September 14, 2004 7:05 am
> Subject: Re: [Ethereal-users] Packets out of Order
> 
> > if your application protocol sits atop tcp, then ethereal 
> will display
> > those packets as [TCP out-of-order].
> > 
> > if your application sits atop something else you will have 
> to add code
> > to detect this.
> > 
> > 
> > 
> > On Mon, 13 Sep 2004 22:31:32 -0400, stankinator@xxxxxxxxxxxxx
> > <stankinator@xxxxxxxxxxxxx> wrote:
> > > How Do I determine from a capture that packets are being 
> > received out of order?
> > > 
> > > _______________________________________________
> > > Ethereal-users mailing list
> > > Ethereal-users@xxxxxxxxxxxx
> > > http://www.ethereal.com/mailman/listinfo/ethereal-users
> > >
> > 
> > _______________________________________________
> > Ethereal-users mailing list
> > Ethereal-users@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-users
> > 
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>