Hi everybody!
Sometime ago I wrote a dissector of TCP-based protocol, and I faced with the problem of TCP out-of-order frames. E.g.:
1) Duplicated packet
2) Out-of-order packet later followed by TCP retransmission
3) Simple reordering
and so on.
Most protocols seems to be tolerant to this. But if you protocol is encrypted or compressed, such event poisons the state of decoder or decompressor and most of times it is unrecoverable.
Does wireshark have anything to handle this? If not is there any demand for such functionality from dissectors' authors?
--
With best regards
Max Dmitrichenko