But more importantly, WHY you should do TCP sequence number analysis. Well, you know all those black and red packets in Wireshark? Sure, you’ve seen them, right? Scary, huh? What if someone says there’s a problem and you see a bunch of those packets in Wireshark. Is that the problem?
This video will show an example of a scary looking section in a capture and walk through exactly what’s going on and if it’s a problem or not. If you’re going to learn packet analysis, it is key that you understand what sequence numbers are for and be able to follow the action in the capture as it relates to the stream of data being tracked by those sequence numbers. The Wireshark Expert Info is just a guide, you need to be able to determine if it’s trustworthy and correct.
Download the pcap