This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tcptrace graph and duplicate ACK

0

Hello, Can someone tell (seeing the attached graph) how many duplicate acks in this trace? When i check the pcap file, i am seeing following 5 duplicate ACks

Time 0.404 ----- > 2 duplicate ACKs Time 0.472 ------> 2 duplicate ACK Time 3.956 ------ > 1 duplicate ACK.

Three retransmissions (in reverse direction) are at 0.7, 1.15 and 2.068.

But looking at the attached graph, there are two dup acks (one tick between 1.1 & 1.2 and other between 2.0 and 2.1) but i dont see them in my pcap file. Not sure if i am understanding correctly how duplicate acks are represented in tcptrace graphs.

Thanks

alt text

asked 09 May '14, 17:08

iWireshark's gravatar image

iWireshark
16557
accept rate: 0%


One Answer:

0

Duplicate ACKs are represented by the little short downward lines. So, in this graph, there appear to be duplicate ACKs around times 0.4, 0.47, 0.7, 1.15, 2.08, 3.9, and 4.0.

It would help if you made the trace file available so we could correlate the graph with the actual packets.

Remember that the trptrace graph, like sll the TCP stream graphs, shows one stream in one direction, based on the selected packet, not all captured packets.

answered 12 May '14, 18:40

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%