[Selçuk Cevher <cevhers@xxxxxxxxx>]

Hi,

I made some tests with Wireshark using some sample PCAP files.

I noticed that Wireshark stores the sequence number of the first segment belonging to a specific connection that it comes across in the PCAP file as the ISN (initial sequence number) of that connection.

I always thought that there might be a possibility that the first segment of a TCP stream (with the sequence number of ISN+1) may appear "after", for example, 2nd segment of a certain TCP connection.

Was this thought totally wrong that we never come across such a case ? or Does Wireshark not handle such a case which may actually occur in practice ?