I am new to using Wireshark. I captured the pcap file using the following command in our linux server which is a receiver in the below scenario:-
tcpdump -ni any -s0 -w <filename>
I am seeing TCP Retransmission and Dup Ack packets from the sender in the network which uses a satellite link. The packets use PPPoE in the link layer and TCP on top of it in transport layer. I am seeing TCP Retransmission/Dup Ack for all packets in this link.
The first packet shows a PPPoE in the link layer, IP, TCP (Protocols in Frame: sll:pppoes:ppp:ip:tcp:data) whereas,the duplicate/retransmitted packet does not show PPPoE and just show the TCP over IP (Protocols in Frame: sll:ip:tcp:data). The time difference between these packets is few milliseconds.
I want to know whether the Retransmission is really happening from the sender or the wireshark is showing incorrectly as Retransmission for the same packet.
Any help on this would be really great !!!
asked 08 Dec '10, 03:47
edited 08 Dec '10, 03:48