Ariel Burbaickij wrote: > Hm, let me formulate then the question other way round: > What is the added value of having separate notion of packets' numbers based > on sequence of their delivery from OS level apart from maybe pointing > to some bug in OS?
It takes less work than sorting and re-numbering the packets. :-) I.e., it's not as if we *set out* to have a separate notion of packet's numbers. We could add code to sort and re-number the packets in Wireshark - that'd mean deferring the reading of the packet contents until they're sorted, or arranging that, in all data structures, we keep pointers to packet structures rather than packet numbers, so that, after the sorting, the new numbers are seen in "Reassembled in" and the like. That wouldn't, of course, work for TShark, which is, by intent and design, one-pass. _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
