The "relative sequence number" is same as "raw sequence number" when tcp.analyze_sequence_numbers:FALSE

This issue was migrated from bug 16604 in our old bug tracker.

Original bug information:

Reporter: Nan Xiao
Status: RESOLVED FIXED
Product: Wireshark
Component: Dissection engine (libwireshark)
OS: All
Platform: All
Version: Git

Attachments:

: The pacp file for testing and verifying.
: TCP Preference

Nan Xiao said:

Created attachment 17778 The pacp file for testing and verifying.

Build Information: 3.2.4 (v3.2.4-0-g893b5a5e)

Compiled (64-bit) with Qt 5.12.6, with libpcap, without POSIX capabilities, with GLib 2.37.6, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4, with GnuTLS 3.4.17, with Gcrypt 1.8.5, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.39.2, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.9.9, with QtMultimedia, with automatic updates using Sparkle, with SpeexDSP (using system library), with SBC, with SpanDSP, with bcg729.

Running on Mac OS X 10.15.4, build 19E287 (Darwin 19.4.0), with Intel(R) Core(TM) i5-8279U CPU @ 2.40GHz (with SSE4.2), with 16384 MB of physical memory, with locale C/UTF-8/C/C/C/C, with dark display mode, with HiDPI, with libpcap version 1.9.1, with GnuTLS 3.4.17, with Gcrypt 1.8.5, with brotli 1.0.7, with zlib 1.2.11, binary plugins supported (19 loaded).

Built using clang 4.2.1 Compatible Apple LLVM 11.0.0 (clang-1100.0.33.16).

Check the attached file, for "SYN" packet, the "relative sequence number" is same as "raw sequence number", and I think "relative sequence number" should be 0.

added libwireshark versiondev labels

Uli Heilmeier said:

Yes, you're right the relative sequence number should normally be 0 for SYN.
However I'm not able to reproduce your issue with 3.2.4 on macOS 10.15.5.

Can you provide more details?
* Does it happen for all TCP sessions?
* Only for a specific session? If yes, can you share the pcap?
* What TCP protocol preferences have you configured?

Chuck Craft said:

Looks like tcp.stream 0 from this capture:
   https://weberblog.net/the-ultimate-pcap/

I was unable to recreate the issue with 3.2.4 on Windows.

Nan Xiao said:

Created attachment 17799 TCP Preference

Nan Xiao said:

@Uli Heilmeier:

Very sorry for late response!

> * Does it happen for all TCP sessions?  

Yes

> * What TCP protocol preferences have you configured?  

Please check attached file.

Thanks very much in advance!

Uli Heilmeier said:

Issue reproducible with the provided TCP settings. After enabling "Analyze TCP sequence number" relative sequence number is shown as 0. Disabling "Analyze TCP sequence number" shows relative sequence number with raw value.

Uli Heilmeier said:

Yes, we currently only calculate the relative sequence number when tcp_analyze_seq is true:

---epan/dissectors/packet-tcp.c---- 6313 /* handle TCP seq# analysis parse all new segments we see */¬ 6314 if(tcp_analyze_seq) {¬ 6315 if(!(pinfo->fd->visited)) {¬ 6316 tcp_analyze_sequence_number(pinfo, tcph->th_seq, tcph->th_ack, tcph->th_seglen, tcph->th_flags, tcph->th_win, tcpd);¬ 6317 }¬ 6318 if(tcpd && tcp_relative_seq) {¬ 6319 (tcph->th_seq) -= tcpd->fwd->base_seq;¬

Gerrit Code Review said:

Change 37469 had a related patch set uploaded by Uli Heilmeier: TCP: show only relative numbers when tcp_analyze_seq is enabled

https://code.wireshark.org/review/37469

Gerrit Code Review said:

Change 37469 merged by Anders Broman: TCP: show relative numbers only when tcp_analyze_seq is enabled

https://code.wireshark.org/review/37469

Gerrit Code Review said:

Change 37548 had a related patch set uploaded by Uli Heilmeier: TCP: show relative numbers only when tcp_analyze_seq is enabled

https://code.wireshark.org/review/37548

Gerrit Code Review said:

Change 37549 had a related patch set uploaded by Uli Heilmeier: TCP: show relative numbers only when tcp_analyze_seq is enabled

https://code.wireshark.org/review/37549

Gerrit Code Review said:

Change 37550 had a related patch set uploaded by Uli Heilmeier: TCP: show relative numbers only when tcp_analyze_seq is enabled

https://code.wireshark.org/review/37550

Gerrit Code Review said:

Change 37548 merged by Anders Broman: TCP: show relative numbers only when tcp_analyze_seq is enabled

https://code.wireshark.org/review/37548

Gerrit Code Review said:

Change 37549 merged by Anders Broman: TCP: show relative numbers only when tcp_analyze_seq is enabled

https://code.wireshark.org/review/37549

Gerrit Code Review said:

Change 37550 merged by Anders Broman: TCP: show relative numbers only when tcp_analyze_seq is enabled

https://code.wireshark.org/review/37550

closed