TCP out-of-order packet events
Another phenomenon that you will see in networks is previous segment loss and out-of-order segments. Both relate to packets arriving out of order, and in some cases indicate a problem.
When you see this on a network connection, it might happen due to network problems or an interruption in capture. In this recipe we will focus on this issue and what it can cause.
Getting ready
Start Wireshark and connect it on a mirrored port. The three phenomena that we want to focus on in this recipe are:
Previous segment lost: This occurs when a packet arrives with a sequence number higher than the next expected sequence number on that connection, indicating that one or more packets prior to the flagged packet did not arrive
Out-of-order packet: This occurs when a packet is seen with a sequence number lower than the previously received packet on that connection
Previous segment not captured (Wireshark Version 1.8.x and higher): This is like the previous segment lost
