Tracking sequence numbers and flags in Wireshark

Tracking sequence numbers and flags in Wireshark

One of the things I learned a while back was a really good tip when using Wireshark. I find people sometimes get tied up tracking the sequence numbers and the wireless frame flags in Wireshark.

Having to open the frames and look for flags and following sequence numbers can be quite complex and time consuming.

Here’s a Wireshark Tip

Here is a little tip I learned, which seems so obvious once someone tells you…

When viewing the frames in Wireshark, the “Info” column can be very informative. It shows the type of frame, and the sequence number (SN). It also shows the SSID name, the Beacon Interval (BI) and also the Flags from the wireless frame header.

One exception to this standard “info” field display is, if you have data that is not encrypted, Wireshark may start to show you the TCP/UDP or HTTP information in the “info” field, then you do have to go and dig, and look inside the frame to see the flag details. Basically, on an unencrypted Wireless network, or if you have entered the PSK intentionally so as you can decrypt packets, this may display actual packet data, not “useful wifi info”.

If we take a look in Diagram 1 below, you will see the Flags are listed underneath the “Flags” section within the “Frame Control Field”. You can also find a summary right next to the “IEEE 802.11 Beacon Frame” section (in fact whatever the type of frame you are viewing, the flags are summarized next to this section). A feature that often goes unnoticed, they are also summarized in the top right section of the Wireshark Frames display, within the “info” field.

 

DIAGRAM 1

 

When the flags are shown next to the “IEEE 802.11 Frame” field (where represents the type of frame shown) or when show within the “info” column, the frame flags are listed using the following format: xxxxxxxxC, where the x’s represent characters that are displayed. The format is displayed as a mix of eight letters followed by an uppercase “C”. If a given flag is not set, it is represented as a period. As you can see in Diagram 1, none of the flags are set, and so the flag field will be represented as eight periods followed by an uppercase “C”.

The eight flags are shown as the following letters in this order: opmPRMFTC

o is the Order bit
p is the protected bit
m is the More Data bit
P is Power Management
R is Retry
M is More Fragments
F is FromDS
T is ToDS

That’s the eight flags!

Well, what’s the “C” then, I hear you ask.

A lot of people misunderstand this, and mis-name this uppercase “C”.

The “C” is there as long as the frame did not fail its CRC check. Now please note this is not the same as the frame passing its CRC check. If for whatever reason the CRC is not present (maybe because you only captured a small segment of the frame e.g. 128B, or you didn’t capture FCS’), Wireshark represents this with an uppercase “C”. This happens whether the frame is corrupt or not and can be quite confusing. So, watch out for that one!

2025 Update...

We talk about this, more, in our AMA series webinars:

https://www.youtube.com/watch?v=TM70jXEsFsk


That’s it for this month. See you next time.

If you are looking to make your mark in the IT Industry, then NC-Expert offers excellent training courses aimed at relevant IT industry certifications – contact us today to get started.

NC-Expert Blog

Wi-Fi Myth Series - Myth #13: Mesh is ALWAYS The Best Solution

By Rie Morgan • September 10, 2026
Mesh Wi-Fi has developed quite the reputation: Need coverage in the far end of the building? Mesh. Can’t get Ethernet to an access point? Mesh. Dead spot upstairs? Mesh. Need Wi-Fi in the warehouse, courtyard, annex, garage, loading dock, or that mysterious conference room where RF signals apparently go to die? Mesh. And there’s a reason for the enthusiasm. Mesh networking can be extremely useful: it can extend connectivity into places where running cable is difficult, expensive, disruptive, or simply impossible. Modern mesh systems can dynamically select paths, recover from connectivity changes, and provide remarkably capable wireless backhaul... but that doesn’t mean mesh is automatically the best architecture. Sometimes the best mesh network is the one you don’t build!

Wi-Fi Myth Series - Myth #12: Auto Channel Selection ALWAYS Knows Best

By Rie Morgan • August 28, 2026
Automatic Channel Selection sounds like one of those features we should simply be able to trust: the APs monitor the RF environment, the Controller gathers data, an Algorithm considers interference, utilization, neighboring APs, channel availability, and other metrics, then Radio Resource Management (RRM) does its “thing” and selects the best channels. Wonderful! One less problem for the wireless engineer to worry about... except RF rarely cooperates with anything quite that neatly! Modern RRM systems are remarkably capable, and automatic channel selection can dramatically simplify the management of large wireless environments, but an algorithm can only make decisions based on the information it collects, the parameters it has been given, and the objectives it has been designed to optimize. That makes automation a powerful engineering tool. It does not make it the engineer.

Wi-Fi Myth Series - Myth #11: Interference Is Always Someone Else’s Wi-Fi

By Rie Morgan • August 20, 2026
When Wi-Fi performance suddenly deteriorates, interference is often the first culprit to be suspected and, when this (interference) enters the conversation, attention tends to turn immediately toward neighboring Wi-Fi networks. “Someone must have installed another AP.” “The office next door is probably using our channel.” “There are too many SSIDs around here.” Sometimes, this diagnosis is exactly right, but RF interference has a much larger cast of characters than just neighboring APs. In fact, some of the most frustrating wireless problems occur when the interfering device isn’t speaking 802.11 at all! The spectrum doesn’t particularly care whether the energy occupying it came from an enterprise AP, a Bluetooth headset, a microwave oven, or something considerably stranger. To a Wi-Fi radio trying to communicate, unwanted RF energy is simply unwanted RF energy. Wi-Fi Has to Share the Neighborhood The 2.4 GHz band has always been something of an RF “community center”. Wi-Fi operates alongside Bluetooth, Zigbee and other technologies, while various consumer, industrial, medical, and electronic devices may also generate energy within or around the same spectrum. Microwave ovens are perhaps the most famous example. Their emissions can interfere with 2.4 GHz Wi-Fi, particularly when clients are operating nearby. Bluetooth devices, cordless equipment, wireless cameras, sensors, and other transmitters can also contribute RF energy. Some interferers transmit continuously. Others appear periodically. Some hop frequencies. Others produce wideband noise. That last category can be particularly entertaining to troubleshoot... in the very specific sense of “entertaining” that wireless engineers use when they have been staring at spectrum analysis for three hours! The important point is that interference doesn’t need to understand Wi-Fi to disrupt it.