Wireshark-dev: [Wireshark-dev] regarding the output of "Follow TCP Stream" command
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Selçuk Cevher <cevhers@xxxxxxxxx>
Date: Thu, 3 Sep 2009 09:17:26 +0300
Hi All,

Is the output of "Follow TCP Stream" command, with the "Entire Conversation" option in drop-down list selected, strictly ordered ?

I am guessing that it is not.

As far as I know, this is theoritically not possible since as an observer in the middle of the communication, it is impossible to know which end of a connection sends a certain data first. In some cases, the two streams coming from each end of a connection may be totally independent of each other.

Can someone please verify this information ?

Thanks.