This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am investigating an issue on a network at the moment and although I have found the issue, it has highlighted a behavior in Wireshark that I hope someone can explain to me. I can't post the pcap as its quite large and contains sensitive data, but the sttached screenshot of the TCP information should help. On this, we are looking at treams with index 0 & 1. alt text You can see that the TCP handshake sets up correctly, and a small amount of data is sent and ACKed in both directions. Then the server sends a [FIN, ACK], but gets no response. Wireshark correctly detects the retransmission of the [FIN, ACK] packets as shown in the screenshot.

As these 'bad clients' have caused issues with the server by not ACKing the [FIN, ACK] packet in the past, I am trying to script the detection of these occurances using tshark.

However if I run the same file through tshark like this:

tshark -r bad-tcp-2.cap -R 'expert.message == "Retransmission (suspected)"'

it doesn't find any of these retransmissions.

Is this a bug in Tshark, or an expected difference in behavior, or just something I am doing wrong int he first place?

asked 04 Feb '14, 01:04

Boidy's gravatar image

Boidy
31226
accept rate: 0%

I appreciate this isn't a support forum for Cascade Pilot, but I can't get that to detect these retransmissions either.

(04 Feb '14, 03:41) Boidy

Please try to run tshark with option -2 (two pass analysis) and

-R 'expert.message contains "Retransmission (suspected)"'

Regards
Kurt

permanent link

answered 04 Feb '14, 01:58

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 04 Feb '14, 02:02

Thanks for your response. The version of Tshark I had installed on the box doesn't support '-2', and its not a trivial job to upgrade it. I put the test pcap file on another platform with the latest Tshark, and your suggestion worked. Surprisingly, running it without -2 and with a -Y option set instead of -R, also found the packets. So I'm guessing that there is bug in the version of TShark I have on my server.

(04 Feb '14, 03:15) Boidy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×752
×104
×16

question asked: 04 Feb '14, 01:04

question was seen: 5,681 times

last updated: 04 Feb '14, 03:41

p​o​w​e​r​e​d by O​S​Q​A