By having it enabled the relative SEQ and ACK numbers will be shown, meaning that all SEQ and ACK numbers always start at 0 for the first packet seen in each conversation.
This is totally up to the user and how you prefer to read it, by disabling it you will see the real/absolute SEQ, Next SEQ and ACK numbers and that can be cumbersome to read. There is one thing more I usually change and that is to disable “Relative sequence numbers” in Wireshark for the TCP protocol. I recommend that you have them in the same order as pictures shows since it will be easier to read, you can also rename the columns to something shorter for example SEQ, Next SEQ and ACK to make it even easier to read.
Wireshark3.png (24.45 KiB) Viewed 37840 times
0 kommentar(er)
