# About resending of packets or out of order packets **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [October 21, 2015, 3:25am UTC](https://discuss.elastic.co/t/about-resending-of-packets-or-out-of-order-packets/32630 "2015-10-21T03:25:04Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![MingchunZhao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mingchunzhao/32/5372_2.png) [@MingchunZhao](https://discuss.elastic.co/u/MingchunZhao)\ **Post date:** [October 21, 2015, 3:25am UTC](https://discuss.elastic.co/t/about-resending-of-packets-or-out-of-order-packets/32630/1 "2015-10-21T03:25:05Z")
Is Packetbeat able to deal with that resending of packets or out of order packets? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 21, 2015, 1:51pm UTC](https://discuss.elastic.co/t/about-resending-of-packets-or-out-of-order-packets/32630/2 "2015-10-21T13:51:03Z")
what kind of packets? UDP or TCP? You really mean packets or messages on application layer? For TCP, the TCP stream will be constructed based on sequence number. If packets is received again it will be removed due to having processed the sequence number earlier. TCP stream handler also deals with packet reordering. For UDP we have no deduplication implemented. UDP packets will be processed as received. ---
**Author:** ![MingchunZhao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mingchunzhao/32/5372_2.png) [@MingchunZhao](https://discuss.elastic.co/u/MingchunZhao)\ **Post date:** [October 21, 2015, 11:55pm UTC](https://discuss.elastic.co/t/about-resending-of-packets-or-out-of-order-packets/32630/3 "2015-10-21T23:55:53Z")
Hi Steffen, Thanks for your reply, What I meant was packets for TCP, and I understand what you explained. Thanks again, Mingchun ---
**Author:** ![Kalyana\_Sundaram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kalyana_sundaram/32/6642_2.png) [@Kalyana\_Sundaram](https://discuss.elastic.co/u/Kalyana_Sundaram)\ **Post date:** [December 15, 2015, 7:50pm UTC](https://discuss.elastic.co/t/about-resending-of-packets-or-out-of-order-packets/32630/4 "2015-12-15T19:50:20Z")
How does reordering of TCP work? I don't see a buffer where packets are stored and reordered for atmost 'tcp\_reordering' times. As far as I understood, tcp packets are assumed in order, if there is an out of order packet detected then the module is asked if the gaps can be neglected and even then things make sense. If the answer is yes the packet is added to stream or stream is deleted saying nothing can be made out of data due to the gap. Aren't we dropping the stream too early ? Might be a noob question if I missed some aspect in the code ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [December 16, 2015, 4:25pm UTC](https://discuss.elastic.co/t/about-resending-of-packets-or-out-of-order-packets/32630/5 "2015-12-16T16:25:11Z")
@Kalyana_Sundaram you're fully right. Just checked the code again and I don't see any buffering either. No idea why I've thought we've buffering and reordering implemented. Thanks for pointing this out. I created a [github issue](https://github.com/elastic/beats/issues/544). Feel free to comment there or submit a PR 😉 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:57pm UTC](https://discuss.elastic.co/t/about-resending-of-packets-or-out-of-order-packets/32630/6 "2017-07-05T21:57:28Z")