Wireshark · Wireshark-users: Re: [Wireshark-users] sorting on packet number and on time gives different results

[Guy Harris <guy@xxxxxxxxxxxx>]

Ariel Burbaickij wrote:
> Hm, let me formulate then the question other way round:
> What is the added value of having separate notion of packets' numbers based
> on sequence of their delivery from OS level apart from maybe pointing
> to some bug in OS?

It takes less work than sorting and re-numbering the packets. :-)

I.e., it's not as if we *set out* to have a separate notion of packet's 
numbers.  We could add code to sort and re-number the packets in 
Wireshark - that'd mean deferring the reading of the packet contents 
until they're sorted, or arranging that, in all data structures, we keep 
pointers to packet structures rather than packet numbers, so that, after 
the sorting, the new numbers are seen in "Reassembled in" and the like. 
 That wouldn't, of course, work for TShark, which is, by intent and 
design, one-pass.