A Quick Note About TCP Sequence Numbers

I’ve received a lot of feedback from my readers expressing their gratitude that my articles/videos are short and to the point. To those people who took the time to send their feedback, thank you.

One topic that I’ve been asked to cover lately is TCP sequence number analysis. There are many videos out there that are very good. I know, since I watched quite a few of them ;)

After watching 4 or 5 of these videos, I noticed that they weren’t geared towards analysts getting into this level of analysis for the first time and missed a few items that I would have added. So here you go.

In this video I briefly’ cover some of the TCP sequence tips and tricks that I use in the field. The important part is to remember that by default Wireshark will display the relative sequence number. It even displays that note in the detail (middle) pane. You can easily toggle this on and off by right clicking on the TCP sequence number (or anywhere in the TCP header), select Protocol Preferences and check/uncheck Relative Sequence numbers.

I also briefly mention that you can also use the netstat –s command from the command prompt to track lost packets by looking at the TCP Segments Retransmitted counter.

The point of the video is to provide a simple introduction so the whole process of TCP analysis becomes a bit more straightforward.

Our Curious Habits (Paul Smith)

 

As an engineer, I’m often accused by my non-engineer brethren of being overly analytical. I confess that I can’t help scrutinizing some things (well...most things) to try and figure out how they work. This can lead to satisfaction and a boost in self-assurance when things work as expected, and a compulsive drive for further analysis when they don’t. I have been blessed (cursed?) with this inclination for as long as I can remember. I have been formally trained for it in school and throughout my career. Reinforced by a lifetime of use, this habit is unlikely to ever change.

Wireshark Display Filter Tip: Show Specific Frame Numbers

 

Wireshark’s features can really be a catch 22. In one way, they are very powerful but on another hand, many of them are difficult to find. Every so often I find a gem of a tip or trick which makes packet analysis a lot easier.

In this video I share a different kind of display filter that you may not be familiar with. I’m sure you have used MAC, IP address, TCP, UDP and maybe even some application layer display filters. I find that sometimes I need to display just a few packets that might not have MAC, IP, TCP or UDP port numbers in common.

As you will see in the video, one way to address this challenge is to simply Mark the packets and then apply a display filter for just marked packets. The other way is to use the following display filter syntax frame.number in {frame numbers} this will simply display any frame number you provide in the curly braces.

By focusing on a lesser‑known display filter, I demonstrate how to cut through noisy captures and quickly zero in on the traffic you actually need to inspect.