Fix Packet Reordering Excessive Detected in Wireshark

Yeah, seeing Packet Reordering Excessive Detected in Wireshark is annoying. You're staring at a clean capture and suddenly that red flag pops up. Let me save you the headache—here's what actually works.

The Quick Fix: Disable TCP Offloading

Before you tear your hair out over router settings, check this first. On Windows (10, 11, Server 2016+), the network driver's TCP offloading features can cause false reordering. The card reorders packets before Wireshark sees them.

Step-by-step to disable TCP offloading

1. Open Device Manager (right-click Start, select it).
2. Expand Network adapters.
3. Right-click your active network card (usually something like Realtek, Intel, or Killer) and choose Properties.
4. Go to the Advanced tab.
5. Look for these entries—turn each one to Disabled:
• Large Send Offload (LSO)
• TCP Checksum Offload (IPv4 and IPv6)
• UDP Checksum Offload
• Receive Side Scaling (RSS) — optional, but turn it off for testing
6. Click OK.
7. Restart your computer. No, don't skip this—the changes won't take effect until the driver reloads.

After reboot, open Wireshark again and capture the same traffic. You should see the reordering warning vanish. If it's gone, that was the culprit. If not, read on.

Why This Works

TCP offloading lets the network card handle packet ordering and checksums instead of the CPU. Sounds great on paper. In practice, especially with older drivers or cheap routers, the card can reorder packets slightly. Wireshark flags that as 'excessive reordering' because it's comparing timestamps. The real issue is the card is sending packets out of order to the OS, not the network itself. Disabling offloading makes the CPU do the work, which is slower but accurate.

Real-world trigger: This happens most often with Realtek PCIe GbE controllers on Windows 10 20H2 and newer. I've seen it daily on Dell OptiPlex 3080s.

When the Quick Fix Doesn't Help: It's Bufferbloat

If disabling offloading didn't fix it, your router is probably bufferbloating. That's when the router's buffer holds packets for too long, then releases them in bursts. Those bursts arrive out of order at your PC.

Test for bufferbloat

Go to Waveform's bufferbloat test. Run it three times and average the results. If you see a grade below 'A' or 'B', you've got bufferbloat.

Fix bufferbloat on your router

1. Log into your router's admin page (usually 192.168.1.1 or 192.168.0.1).
2. Find QoS (Quality of Service) settings. On Asus routers, it's under Adaptive QoS. On TP-Link, it's under Bandwidth Control.
3. Enable Smart Queue Management (SQM) or FQ-CoDel if available. These algorithms actively drop packets to keep buffer small.
4. Set your upload and download bandwidth to 90% of your actual speed. For example, if you pay for 100 Mbps down, set it to 90 Mbps. This prevents the buffer from filling up entirely.
5. Apply and reboot the router.

Re-run the bufferbloat test. You should see a grade A or B now. Then test with Wireshark again. The reordering warnings should drop significantly.

No QoS options? Upgrade your router firmware to something like DD-WRT or OpenWrt. These open-source firmwares include SQM by default. Or just buy a router known for good buffer management—I've had great luck with Ubiquiti EdgeRouter X or Asus RT-AX86U.

Less Common Variation: ISP Side Reordering

Sometimes the reordering isn't your gear. It's your ISP's routing. This is rare but real. You'll see reordering on multiple devices on different networks, even with offloading disabled and router QoS enabled.

How to check

Run a traceroute to your ISP's first hop:

tracert 8.8.8.8 (Windows)
traceroute 8.8.8.8 (Mac/Linux)

Look for high latency on the first or second hop. If you see spikes above 50ms, your ISP's gear is buffering. Call them and say 'I'm seeing packet reordering on your first hop routers.' They'll probably tell you to reboot your modem and call back. Do that, then escalate to a tier 2 tech.

Your options:

• Ask them to check their routing tables for asymmetric routes.
• If they won't help, switch to a different ISP if available.
• Use a VPN. A VPN tunnels your traffic through a different path, which can bypass the reordering segment. Not ideal, but it works.

Prevention: Keep Bufferbloat in Check

Here's how to keep this from coming back:

1. Run a bufferbloat test monthly. Set a reminder on your phone. I use Waveform's test every first Sunday.
2. Keep router firmware updated. Newer firmware often improves buffer management. Check every 3 months.
3. Don't download while gaming or video calling. Large downloads—Steam updates, torrents, Windows updates—fill your buffer fast. Use QoS to prioritize latency-sensitive traffic.
4. If you're a power user, install a router with FQ-CoDel (like OpenWrt or a Ubiquiti Edgerouter). These handle reordering and bufferbloat automatically. Set it and forget it.

That's it. You won't see Packet Reordering Excessive Detected again unless something's seriously wrong on the ISP side. And now you know how to handle that too.