TurboCap card / out-of-order frames

[Stuart Kendrick <skendric () fhcrc org>]

I'm using a TurboCap card to capture in-line with an end-station.

Repeatedly through the trace, I see out of order frames.  For example,

[Numbers are TCP segment numbers]

Client ACKs     Server sends Segment    Frame #
1,183,091                               22034
                1,179,039               22035
                1,180,499               22036
                1,181,959               22037
                1,183,091               22038
                1,179,039               22041
1,183,091                               22042

And then, I even see an out-of-order three-way TCP handshake:


Client sends SYN                                                    28898
Client sends ACK                                                    28899
Server sends SYN-ACK                                         28900


I don't believe that that the client really sent the ACK before 
receiving the SYN-ACK.

So I'm beginning to think that the TurboCap card misorders frames when 
it captures.

I captured using 'dumpcap -i 6 -w rollingcapture.pcap -b filesize:50000'

TurboCap driver v1.3

Anyone else seen this issue?

--sk

Stuart Kendrick
FHCRC


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe