Thanks. I checked "Analyze TCP sequence numbers" and that did the trick.
I have been using ethereal for about 5 months and had no
idea this was available. I searched the doc high and low
and found nothing.
This seems like such a useful feature that maybe there should be some
mention in
the getting started guide. A new user might actually read that.
Don't get me wrong I am grateful for this very useful tool.
Bill
Guy Harris wrote:
> On Thu, Mar 11, 2004 at 08:07:53PM -0800, Bill Hecox wrote:
> > Someone sent me a cap file today. We were reviewing the file
> > and he said see the additional information in the info field.
> >
> > He had something like duplicate packet or similar info.
> > I did not see this in my info field.
> >
> > Is there an expert mode similar to SNIFFER?
>
> No.
>
> The TCP dissector has *some* capabilities along those lines.
>
> > How do I activate this feature?
>
> You can activate the TCP feature by selecting "Preferences" from the
> "Edit" menu, opening up the "Protocols" list in the Preferences dialog
> box, selecting TCP, turning on "Analyze TCP sequence numbers", clicking
> "Save" if you want that to be the default, and clicking "OK".
>
> That would detect TCP retransmissions, but it won't do anything for
> other protocols.
