This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

“tcp previous segment not captured”

0

greetings, what does "tcp previous segment not captured" indicate? I am running wireshark when trying to connect to a wireless windows 7 vnc server from a wireless ubuntu laptop.

asked 07 Sep '12, 20:05

bishop2001's gravatar image

bishop2001
1111
accept rate: 0%


One Answer:

0

It means that Wireshark (or whatever program you used to capture the traffic) either wasn't fast enough to cope with the amount of data the NIC received (dropped frames due to performance problems or WiFi "half duplex" operation), or that the frame actually wasn't on the "wire" - meaning, that Wireshark detected packet loss. You usually can tell by looking for a retransmission of the missing packet - if you see it, you most likely didn't suffer dropped frames. Instead, you have packet loss or Out of Order arrivals.

Actually, this message is new replacement in version 1.8.x; in former versions of Wireshark it was "tcp previous segment lost".

answered 08 Sep '12, 04:20

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 08 Sep '12, 04:21