Ethereal-users: Re: [Ethereal-users] TCP Sequence Number Differs From Sniffer Basic

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Wed, 7 Apr 2004 19:48:54 +0200
Ronnie Sahlberg wrote:
> Since the sequence number values themself lack any specific semantic
meaning
> other than their values relative to other segments in the same stream
> ethereal by default will translate them to values relative to the initial
> segment seen in the capture.
> This makes the numbers smaller and much easier to read by eyeballing.
>
> Studying two sequence numbers     5000 and 6500 it is trivial and quick to
> eyeball them and in a fraction of seconds see that the number of bytes in
> the sequence number space between these segments are 1500 bytes. since the
> values are so small they are easilably viewabable by just looking at them.
> Eyeballing the true sequence numbers  example  165793482  and 165794982 is
> MUCH more difficult even if the delte here as well is only 1500 bytes.
> It takes much more effort and longer time, often with the need to write
them
> down on paper.
> That is a waste of time and user unfriendly since other then the relative
> difference between them they lack any semantic meaning.

Several people I know have been confused when comparing results between
different tools and similar.
I think that it might be good to add some information that the sequence
number is relative when that
setting is used, e.g. "Sequence number: 140 (relative)" or maybe show both
the relative value and the non-relative value.