This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Conversations with DUP or Retransmission

0

I read how to get a count of conversations - my next question is is there a way to count how many different conversations have DUP or TCP Retransmission packets in them?

asked 22 Nov '13, 13:43

Platzen's gravatar image

Platzen
11●1●1●3
accept rate: 0%

One Answer:

2

There are several ways to do that. One fast and simple method is this:

  • set a display filter for the conditions you're looking for, e.g. tcp.analysis.retransmission or tcp.analysis.duplicate_ack (add whatever field you need)
  • show the conversations: Statistics -> Conversations -> TCP [tab]
  • enable the following option: Limit to display filter (at the bottom of the window)
  • what you now see are those TCP connections that match the display filter, hence those connections with retransmissions and dup ACK (in this example)

Regards
Kurt

answered 22 Nov '13, 14:46

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 22 Nov '13, 15:03