How to Do TCP Sequence Number Analysis

I’m going to go out on a limb here and say that the ~200 ms pause you mention towards the end of the video was a TCP delayed ACK.

Great post Kary, thanks!

Excellent post!

It would great if you could have a post about how to use TTL, Mac addresses etc. to pick up a transparent device interfering with the flow

Very helpful explanation again – thanks for that.
What’s wrong with IPX ? ;-)
If i read the RCF correct the 200ms could also be up to 500ms :-)
I’m always confused about Wiresharks interpretation of ‘TCP Out of Order’ – since there is a SACK before requesting the missing packets. So i would prefere wireshark to name out of order packets following a SACK frame ‘Requested retransmission’ – although out of order is correct.
Another useful colum i use is the ‘Delta Time’

regards
Helmuth

is there a way to download the capture file you was using in the video ?

Just discovered your site and loving the in-depth tutorials.

One question: How do you get the “Nxt Seq” column to calculate? I’m not seeing it as a default option and I’m not sure how to do something like “tcp.seq + tcp.payload.length”

Thanks!

Would like to view your tutorials but sadly i am experiencing network peformance issues on my fixed wirless slow band internet service.

Im just sick of the excuses when it comes to fixed wireless broadband. “Oh it’s the wind a tree branch is probably blowing in front of it”. When no wind is around yet when the trees are blowing i have no problems on my 512kbs slowband. So why all of a sudden now. i just know for a fact that when doing support work at a school the EDU or victorias school education internet service in victoria oz.The support admins would never admit that it was a problem on their end.
Our home slowband is government subsidised by our previous government whom was in power and is now being replaced by the NBN. Which is a farce in itself and has certaintly made me decide whom I vote for in this election that is taking place.I some what wonder if the isp is just letting the old legacy previous labour party goverment broadband to run into the ground to force people to switch over to the NBN?…

Thx. Kary!
Very valuable (and enjoyable! :)) video (I had to troubleshoot IPX and APPLETALK way back in the ninties …)!
May I ask you for the coloring rule (delay > 200ms or so)?
Thx. again!
Keep on …

Great tutorial thanks. Thought it would be help to show the packet-foo url: https://blog.packet-foo.com/

One other point, I was confused by how to add the Seq number columns. I think the key thing is to select a TCP packet in the trace. Even then the ‘Next seq number’ is not always shown in the details pane. Could do with some more explanation there.

Hi, getting a 404 on the dropbox vpn_rewrite.pcap link.

I AM NOT SURE THE REASON OF WHY THERE WAS A PAUSE OF AROUND 200ms in the VIDEO THAT YOU WERE TALKING ABOUT AT 14:46 SECONDS.KINDLY LET ME KNOW.

THANKS