This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I read how to get a count of conversations - my next question is is there a way to count how many different conversations have DUP or TCP Retransmission packets in them?

asked 22 Nov '13, 13:43

Platzen's gravatar image

Platzen
11113
accept rate: 0%


There are several ways to do that. One fast and simple method is this:

  • set a display filter for the conditions you're looking for, e.g. tcp.analysis.retransmission or tcp.analysis.duplicate_ack (add whatever field you need)
  • show the conversations: Statistics -> Conversations -> TCP [tab]
  • enable the following option: Limit to display filter (at the bottom of the window)
  • what you now see are those TCP connections that match the display filter, hence those connections with retransmissions and dup ACK (in this example)

Regards
Kurt

permanent link

answered 22 Nov '13, 14:46

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 22 Nov '13, 15:03

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×104
×42
×34

question asked: 22 Nov '13, 13:43

question was seen: 4,399 times

last updated: 22 Nov '13, 15:03

p​o​w​e​r​e​d by O​S​Q​A