We use a few different packet analysis suites - Wireshark being one of the main ones. One of the biggest problems I have is Wireshark's often incorrect assumption about retransmitted packets. I know that NG and OpNet follow an entire TCP stream before assessing the number of retransmissions - but I'm not sure how WireShark handles it. Another issue we're having right now is a few of our probes are tapped into fiber uplinks - and as of a recent code change the packets aren't always being written onto disk in the correct order (maybe off just a few ms) - and this has thrown WS for a loop. I expected the number of OOS packets to go up, which it did, but the number of suspected retransmissions has gone through the roof. Is there a way to avoid this?
asked 29 Sep '10, 10:31
You can read the code at http://anonsvn.wireshark.org/viewvc/trunk-1.4/epan/dissectors/packet-tcp.c?revision=33861&view=markup (that's the location for verion 1.4.0) - search for:
That section explains how the decision to mark a packet as a retransmission/fast_retransmission/out-of-order is made.
You could turn off TCP Preferences Analyze Sequence Numbers, but then you'd miss so much interpretation of TCP issues...
Hope this helps.
answered 29 Sep '10, 16:20