Wireshark Dissector: How to Identify Missing UDP Frames?

Question

How do you identify missing UDP frames in a custom Wireshark dissector?

I have written a custom dissector for the CQS feed (reference page). One of our servers gaps when receiving this feed. According to Wireshark, some UDP frames are never received. I know that the frames were sent because all of our other servers are gap-free.

A CQS frame consists of multiple messages, each having its own sequence number. My custom dissector provides the following data to Wireshark:

cqs.frame_gaps          - the number of gaps within a UDP frame (always zero)
cqs.frame_first_seq     - the first sequence number in a UDP frame
cqs.frame_expected_seq  - the first sequence number expected in the next UDP frame
cqs.frame_msg_count     - the number of messages in this UDP frame

And I am displaying each of these values in custom columns, as shown in this screenshot:

I tried adding code to my dissector that simply saves the last-processed sequence number (as a local static), and flags gaps when the dissector processes a frame where current_sequence != (previous_sequence + 1). This did not work because the dissector can be called in random-access order, depending on where you click in the GUI. So you could process frame 10, then frame 15, then frame 11, etc.

Is there any way for my dissector to know if the frame that came before it (or the frame that follows) is missing?

The dissector is written in C.

(See also a companion post on serverfault.com)

Answer 1

I don't konw if you can peek into previous or following frames, but when Wireshark is loading a tcpdump it will call your dissector on each of the frames in order. So I could add a static local variable which is an array or hash table and simply store your values in there. Then your dissector can check that array for previous and following frames and do its analysis.

You should look at that pinfo vairable, that's one of the function arguments for information about the frame number, IP information etc.