Home/ Questions/Q 6153139
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T20:02:36+00:00

For some research reason, I need to get the http package’s tcp sequence numbers.

  • 0

For some research reason, I need to get the http package’s tcp sequence numbers. I have already got the pcap file, so how should I do that with tshark?

Thanks so much for answer my question!!!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Something like this should do it:

    tshark -r your_file -R http -T fields -e tcp.seq

    The sequence numbers are relative or absolute as controlled by .wireshark/preferences. By default it’s relative (so you will see small numbers). If you want absolute sequence numbers, edit preferences:

    tcp.relative_sequence_numbers: FALSE
    • 0