This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tcp.analysis.retransmission

0

Hi, Can anyone tell me that How is the tcp.analysis.retransmission works? Is it analysis only on time interval or other thing?

asked 11 Dec '12, 10:18

Saruul's gravatar image

Saruul
6113
accept rate: 0%


One Answer:

4

It is triggered when a packet containing a sequence is seen that should have arrived earlier, which means that there must have been a gap in the packet sequence that the "retransmission" packet closes or partially closes. If I remember correctly it also needs to arrive more than 3ms after the gap starts, otherwise it is marked as out of order, but I may be mistaken.

answered 11 Dec '12, 10:41

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Heh - you just answered a question we were discussing in a live trouleshooting/diagnostic discussion - many thanks!

(11 Dec '12, 13:34) wesmorgan1

Thanks, Jasper :) I think wireshark is the best packet analyzer for TCP packets.

(13 Dec '12, 10:59) Saruul

This post is helpful :). I was just checking a network trace with duplex mismatch. I was trying to calculate how much data did I unnecessarily transfer. I was uploading 3MB big file. When I checked amount of transferred data using filter "data", there was 4,2MB transferred (about 30% more). But when I was checking retransferred data using tcp.analysis.retransmission, there was just about 6% more. And then I finally tried filter "tcp.analysis.retransmission || tcp.analysis.out_of_order" and got the desired amount 30% of data more. There really were several packets visible twice where one of them was segment out of order.

(26 Aug '13, 08:45) garw