This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is the different between TCP Previous segment not captured and TCP Previous segment lost message?

0

alt text

What is the different between TCP Previous segment not captured and TCP Previous segment lost message?

and Is this messages is critical error ?

thanks.

asked 18 May '16, 23:09

DSLab's gravatar image

DSLab
1223
accept rate: 0%


One Answer:

1

There is no difference - it's the same diagnostic message, but the wording was changed to be more exact. When a TCP segment isn't seen in the capture file there are a couple of reasons why:

  1. it was never on the "wire", because the capture device was placed at a location where the packet did not pass through (e.g. when routing is using different paths for both directions)
  2. it was lost before it arrived at the capture device (and the destination), which means true packet loss
  3. the capture device was too slow to record all packets (capture device performance problem)

The old message "segment lost" suggested only the second reason. The new message simply says "the segment is not in the capture, for whatever reason". So it covers all three reasons instead of just one.

Regarding "critical error": it depends. When it is not in the capture file because of reason 2, and it happens a lot (costing time), it may get critical. Otherwise it may not, because packet loss simply happens in almost any network - but it doesn't need to be critical if a retransmission is fast enough not to slow things down.

answered 19 May '16, 01:07

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 19 May '16, 01:10

thanks for your answer!

(23 May '16, 01:58) DSLab

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(23 May '16, 02:23) grahamb ♦