This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Log packets @ my router

0

Hi,

We currently are having an issue with our router randomly dropping (internally). Our ISP replaced the router, but it's still happening. She mentioned it could be a bad packet, etc. Is there a way to monitor a specific IP (the router - LAN side) so I can try and narrow what's causing it to drop?

Thanks brian

asked 28 Sep '11, 10:09

slothy's gravatar image

slothy
6225
accept rate: 0%

edited 29 Sep '11, 00:04

helloworld's gravatar image

helloworld
3.1k42041


One Answer:

1

Monitoring a specific IP from the outside can be done by setting a display filter to that IP address. An inside IP address can only be monitored if your router is capable of mirroring the date from other users to a specific port, which in most cases on home routers is not possible.

Anyways: You'll have to check if you see packet loss on the inside interfaces of your router. Try going for tcp.analysis.flags which will give you some idea what is happening inside your TCP connections and search for "previous segment lost" and "(Fast) Retransmission". Although Wireshark cannot tell 100% for sure, that there have been retransmissions, it might give you some hints on what to look for

answered 29 Sep '11, 01:47

Landi's gravatar image

Landi
2.3k51442
accept rate: 28%

edited 29 Sep '11, 01:49