I have a capture maked from mobile device. In capture, I can not understand how Wireshark distinguishes retransmitted packets and out of order packets. I have the first packet transmitted with seq number 1302655196. The next two packets with this sequence number are marked as retransmitted while the others are marked as out-of-order, even though epoch time higher than the retransmitted packets. I would like to understand why.
asked 17 Apr '16, 21:48
edited 19 Apr '16, 06:33
OKay, so that's still not the pcap file but just a screenshot, but it tells us that both Seq and Ack values are the same for all the frames, so all of them are actually retransmissions of frame 89.
However, if you look between 91 and 261 for that TCP session's packets in the opposite direction (i.e. from 192.168.1.11:52651 to 172.27.9.241:80), you'll find there one whose Ack value matches (or is higher than) the Seq value of frame 89.
In another words: when frame 89 comes in, Wireshark's TCP dissector marks it as the original packet. All its retransmissions until it's been ACKed in the opposite direction are marked as retransmissions, and all its retransmissions after it's been ACKed are marked as out-of-order packets. The retransmissions 261-263 happened between the time when the ACK for 89 has passed through the interface on which you capture and the time when it has reached the sender of the 89.
answered 19 Apr '16, 05:31
edited 19 Apr '16, 06:27