Change the indication for out-of-order packets. This is experimental

and will be verified by Jasper next week

Change-Id: I3cda397285e8174abb9c05b7aaf7c1bfabdfc71a
Reviewed-on: https://code.wireshark.org/review/2408
Reviewed-by: Jörg Mayer <jmayer@loplof.de>

1 files changed, 7 insertions, 5 deletions

diff --git a/epan/dissectors/packet-tcp.c b/epan/dissectors/packet-tcp.c
index 6e76be0de1..3dad57fb3a 100644
--- a/epan/dissectors/packet-tcp.c
+++ b/epan/dissectors/packet-tcp.c
@@ -1146,6 +1146,11 @@ finished_fwd:
     &&  tcpd->fwd->nextseq
     &&  (LT_SEQ(seq, tcpd->fwd->nextseq)) ) {
         guint64 t;
+        guint64 ooo_thres;
+        if (tcpd->ts_first_rtt.nsecs == 0 && tcpd->ts_first_rtt.secs == 0)
+                ooo_thres = 200000000;
+        else
+                ooo_thres = tcpd->ts_first_rtt.nsecs + tcpd->ts_first_rtt.secs*1000000000;
 
         if(tcpd->ta && (tcpd->ta->flags&TCP_A_KEEP_ALIVE) ) {
             goto finished_checking_retransmission_type;
@@ -1170,16 +1175,13 @@ finished_fwd:
             goto finished_checking_retransmission_type;
         }
 
-        /* If the segment came <3ms since the segment with the highest
+        /* If the segment came relativly close since the segment with the highest
          * seen sequence number and it doesn't look like a retransmission
          * then it is an OUT-OF-ORDER segment.
-         *   (3ms is an arbitrary number)
-         * FIXME: Use initial RTT for this connection as a base value
-         *        or even better iRTT + 200ms
          */
         t=(pinfo->fd->abs_ts.secs-tcpd->fwd->nextseqtime.secs)*1000000000;
         t=t+(pinfo->fd->abs_ts.nsecs)-tcpd->fwd->nextseqtime.nsecs;
-        if( t<3000000
+        if( t < ooo_thres
         && tcpd->fwd->nextseq != seq + seglen ) {
             if(!tcpd->ta) {
                 tcp_analyze_get_acked_struct(pinfo->fd->num, seq, ack, TRUE, tcpd);