Option 1:
First, set up capture to start on a sequence error. This means no frames will be captured until we see the first sequence error.
Then set up capture to only keep frames with sequence errors. This will ensure that only frames with sequence errors will be kept in the buffer.
Option 2:
If you want to find an out of sequence "pattern", you may want to capture all packets including OOS packets, you may want to reduce the load, and capture all traffic (No using any event)