Geek Answers Handbook

Wireshark Dispersion: How to identify missing UDP frames?

How to identify missing UDP frames in a special Wireshark analyzer?

I wrote a special dissector for the CQS channel ( man page ). One of our servers skips on receiving this channel. According to Wireshark, some UDP frames are never accepted. I know that frames were sent because there are no spaces on all our other servers.

A CQS frame consists of several messages, each of which has its own sequence number. My custom analyzer provides the following data in Wireshark:

cqs.frame_gaps          - the number of gaps within a UDP frame (always zero)
cqs.frame_first_seq     - the first sequence number in a UDP frame
cqs.frame_expected_seq  - the first sequence number expected in the next UDP frame
cqs.frame_msg_count     - the number of messages in this UDP frame

And I display each of these values ​​in custom columns, as shown in this screenshot: wireshark screenshot

, ( ) , , current_sequence != (previous_sequence + 1). , , , . , 10, 15, 11 ..

, ( )?

C.

(. serverfault.com).

+6
2

, Wireshark . . , __ .

, fot ther first time:

 if (PINFO_IS_VISITED(pinfo)) { ... };

- .

(, -) . , , .

+4

, , Wireshark tcpdump, . , - . .

pinfo vairable, , IP ..

0

More articles:


All Articles