Finding Missing UDP Frames Using Wireshark + Custom Dissector (for CQS)
- by John Dibling
How do you use Wireshark to identify missing UDP frames?
I have written a custom dissector for the CQS feed (reference page). One of our servers gaps when receiving this feed. According to Wireshark, some UDP frames are never received. I know that the frames were sent because all of our other servers are gap-free.
A CQS frame consists of multiple messages, each having its own sequence number. My custom dissector provides the following data to Wireshark:
cqs.frame_gaps - the number of gaps within a UDP frame (always zero)
cqs.frame_first_seq - the first sequence number in a UDP frame
cqs.frame_expected_seq - the first sequence number expected in the next UDP frame
cqs.frame_msg_count - the number of messages in this UDP frame
And I am displaying each of these values in custom columns, as shown in this screenshot:
A typical CQS log will consist of millions of rows, so I can't just eyeball it. Is there any way I can get Wireshark to tell me which frames are missing?