This article explains the expected behavior of out-of-order (OOO) packets observed in packet captures (PCAPs) taken from SRX Series firewalls. It also provides guidance on how to validate whether OOO packets captured with Wireshark represent a true forwarding issue or an expected result of SRX’s internal packet processing architecture.
If OOO counters from the PCAP shows higher in number on egress rather than ingress interfaces on the firewall and this can be analyzed from the "Analyze" section of the Wireshark and select "Expert Information" option and will show you the numbers of the OOO counters on each pcaps at ingress and egress packets.
Wireshark analysis shows OOO packets, visible via:
Analyze → Expert Information in Wireshark.
Comparison between ingress and egress PCAPs taken on SRX.
Higher OOO counts are seen on egress interfaces.
When analyzing traffic captures from SRX firewalls, engineers may observe that packets appear to be out of order in the captured data — particularly in PCAPs taken from interfaces or firewall filters.
This can lead to confusion when OOO counters in Wireshark show higher values suggesting that packets are leaving the SRX out of sequence. However, this observation does not necessarily indicate a problem with packet forwarding. It is often a result of how SRX handles packet capture internally.
Because PCAPs taken via firewall filters capture packets before they reach the POT, any packet sequence discrepancies observed in Wireshark are expected.
SRX Internal Flow
pcap Packet Ordering
| |
RT thread ------> Unordered packets----->POT----------Ordered Egress packets--->
To validate this behavior, a controlled test was performed in the Juniper lab using the following topology:
Client-VM------ge-0/0/2[SRX380]--xe-0/0/19---ge-0/0/4--SRX4100--xe-0/0/0----Server-VM
Test Summary:
Traffic Volume: 3 GB between client and server.
Observation on SRX380 (ge-0/0/2): 2091 OOO packets observed in RT-thread capture.
Observation on Client-side Capture: All packets received in sequence (0 OOO).
The test confirmed that out-of-order packets were corrected by the POT before egress transmission — verifying this as expected behavior.
Conclusion:
SRX1500 and branch SRX platforms use LBT-POT architecture (Load-Balancing Thread – Packet Ordering Thread).
Packets belonging to the same session may be processed by multiple RT threads simultaneously.
POT ensures proper sequence before transmission, guaranteeing in-order delivery.
Captures taken on RT threads or via firewall filter pcap may show OOO packets even though packets are transmitted in correct order on the wire.
firewall filter pcap