This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am trying to get the RTO in a custom column but it doesn´t work, also I can´t find the value manualy. In several tutorials the value is at "Transmission Control Protocol" -> "SEQ/ACK Analysis" -> "TCP Analysis Flags" -> "Expert Info" . But there is no "TCP Analysis Flags". So I tried another way. . .
https://www.wireshark.org/docs/dfref/t/tcp.html
I added a new column at Column-Preferences:
- FIELD NAME -> tcp.analysis.rto
- TYPE -> custom
But it stays empty. I am out of ideas.

greetings peacemaker

asked 28 Dec '16, 15:21

peacemaker's gravatar image

peacemaker
11225
accept rate: 100%

edited 28 Dec '16, 16:17

Bob%20Jones's gravatar image

Bob Jones
1.0k2515


It seems to work OK for me, as shown:

alt text

with

alt text

Do you actually have retransmissions for an RTO to be measured? Otherwise, I find this field will be blank.

permanent link

answered 28 Dec '16, 16:03

Bob%20Jones's gravatar image

Bob Jones
1.0k2515
accept rate: 21%

I created another file with trpt (transliterate protocol trace) there I got rxtcur (current retransmit value). But that file was rly huge and I wanted wireshark do all the work for me, so I spend a whole hour trying to get this goin. And in the end there were no retransmissions.

I thought I could get the current retransmit value sorted by wireshark but I guess my TCPdump didn´t contain that information ... time well spend I´d say

(28 Dec '16, 16:44) peacemaker
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×29
×5
×1

question asked: 28 Dec '16, 15:21

question was seen: 2,052 times

last updated: 28 Dec '16, 16:47

p​o​w​e​r​e​d by O​S​Q​A