It does happen from time to time.
Most commonly when you have a retransmitted packet early in the trace
that has a sequence number "before" the first packet seen.
In that case those retransmitted packets just get a negative sequence
number (~ -2 billion something).
You get used to it and it is no
Hi,
I made some tests with Wireshark using some sample PCAP files.
I noticed that Wireshark stores the sequence number of the first segment
belonging to a specific connection that it comes across in the PCAP file as
the ISN (initial sequence number) of that connection.
I always thought that ther
