In Wireshark, TCP sequence numbers are displayed as relative sequence numbers by default. How can I get the actual TCP sequence number?
2 Answers
As per the official Wireshark wiki page:
By default Wireshark and TShark will keep track of all TCP sessions and convert all Sequence Numbers (SEQ numbers) and Acknowledge Numbers (ACK Numbers) into relative numbers. This means that instead of displaying the real/absolute SEQ and ACK numbers in the display, Wireshark will display a SEQ and ACK number relative to the first seen segment for that conversation.
But as explained on that same page, this can be adjusted as follows:
To disable relative sequence numbers and instead display them as the real absolute numbers, go to the TCP preferences and untick the box for relative sequence numbers.
If you require specific directions on where exactly to find the option in Wireshark, like I did, you can can find them at:
Edit > Preferences > Protocols > TCP
Uncheck the option: "Relative sequence numbers"
NB: I'm using Wireshark 2 and haven't checked if it's the same on other versions of Wireshark. (Chances are that it should be in the same place).
