Wireshark · Wireshark-users: Re: [Wireshark-users] Proposed changes to make tcp.ack and tcp.seq relative

[Sake Blok | SYN-bit <sake.blok@xxxxxxxxxx>]

> On 4 May 2020 (Mon), at 22:50, Peter Wu <peter@xxxxxxxxxxxxx> wrote:
> 
> My proposed change:
> 
> - Change the TCP sequence number-related fields to display the relative
>   numbers when available. Fallback to raw numbers if they are simply
>   not available (for example, when the "Analyze TCP sequence numbers"
>   preference is disabled).
> - Modify the "Relative sequence numbers" preference to affect the
>   displayed value in the Info column only.
> - The raw fields will always be available through the existing
>   tcp.ack_abs and tcp.seq_abs fields. Previously they were only visible
>   when "Relative sequence numbers" was disabled. This field was added
>   in Wireshark 3.2.
> - Document these changes clearly in the release notes and corresponding
>   user guides if needed.
> 
> Are there any objections to this change?

Nope, they sound good to me and will make things more consistent (with the small correction that the fields are *_raw instead of *_abs).

A few additions:

- "tcp.nxtseq" will need to have a "tcp.nxtseq_raw" added
- "tcp.options.sack_le" and "tcp.options.sack_re" will also need *_raw versions

Cheers,
Sake