This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I guess using a filter like: tcp.analysis.lost_segment && tcp.analysis.ack_lost_segment could display the packets that are not in the capture file nor in the wire. The receiver doesn't have them at all.

asked 31 Jul '15, 11:44

flora's gravatar image

flora
156313338
accept rate: 100%

closed 04 Aug '15, 06:55

The question has been closed for the following reason "Duplicate Question" by flora 04 Aug '15, 06:55


Easily said no. But this can indicate missing packets:

tcp.analysis.lost_segment or tcp.analysis.ack_lost_segment

tcp.analysis.lost_segment is telling you just that the frame is not in capture file. One probably reason can be indeed that the frame was not on the wire at the capture point another reason can be for example that the frame was not captured correctly.

tcp.analysis.ack_lost_segment is telling you that the corresponding segment is not in the tracefile but the correct answer for the missing segment is in the tracefile. The most likely reason for that is that the endpoint has seen the missing segment and acknowledged it correctly.

permanent link

answered 31 Jul '15, 16:34

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×349
×205
×36

question asked: 31 Jul '15, 11:44

question was seen: 3,506 times

last updated: 04 Aug '15, 06:55

p​o​w​e​r​e​d by O​S​Q​A