Hi guys, I just want to ask you what information that Wireshark needs to check before it recognize that packet is a retransmission packet. If it does based on IP Identification and Transport Layer Checksum value, Wireshark needs to compare the retransmission packet's data to previous packet's data, does it not?
asked 18 Jun '13, 08:41
it compares the sequence numbers to what it has determined to be the next expected sequence number from the last packet of the the conversation into the same direction, by packet order (not by timestamp). It does not care about checksum or ip id.
answered 18 Jun '13, 08:52