Ethereal-dev: Re: [Ethereal-dev] TCP reassembly retransmission/overlap flags

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 22 Jul 2002 13:16:14 -0700
On Tue, Jul 23, 2002 at 05:38:56AM +1000, Ronnie Sahlberg wrote:
> It basically offers an option you can enable and which will remember state
> for each TCP conversation

That could also allow Ethereal to display relative sequence numbers for
TCP segments (that's what tcpdump does by default; the "-S" flag makes
it display the absolute sequence number that appears in the packet -
note that without "-S", tcpdump can run out of memory when dissecting,
say, a trace of an attack by somebody spewing SYNs, so there are reasons
why you might want to disable the option in Ethereal/Tethereal in some
cases).