I'm just curious to know how does one differentiate between upstream and downstream packet loss? I do know how to filter out for packet loss, but I don't know how to differentiate between upstream and downstream packet loss. Thanks! asked 17 Nov '14, 22:49  Beldum |
One Answer:
You can usually tell by the fact if you see a retransmission and the original (meaning, loss occurs after your capture location) or just the retransmission (loss occuring before your capture location). answered 17 Nov '14, 23:33  Jasper ♦♦ |
So when you see a retransmission and the original packet, is that downstream packet loss? And if you don't see an original packet that is upstream packet loss..? How does one check for that in wireshark?
There's the question of what upstream/downstream means for you exactly... everybody may have a different idea of which is which.
Let's say you're capturing in the middle between client and server, and you see packet and its retransmission coming from the server towards the client - that means that the packet loss is closer to the client from your capture location. If you only see the retransmission, it's closer to the server from your capture location.
Determining if there is an original and its retransmission is simple: if you see a retransmission, check if you can find an earlier packet with the same sequence number containing a non zero payload - if you do, you have the original (payload size may vary, but must not be empty).