Wireshark-users: Re: [Wireshark-users] TCP Analysis Flags do NOT show Duplicate ACK's & Retransmi
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 25 Jun 2008 20:02:57 +0200
On Wed, Jun 25, 2008 at 12:57:53PM -0400, Feeny, Michael (GWM-CAI) wrote:
>  
> What is puzzling me is that Wireshark is NOT reporting the Dupe ACK's or
> Retransmissions.  *I* am able to see them (28 packets in a row from one
> side, with no data, and with identical sequence & ack numbers;  then, a
> packet from the other side with the sequence number matching the 28
> ACK's, which packet had been sent previously by this server).  Not only
> do these diagnoses not appear in the "Info" column of the Packet List,
> but, if I enter a Display Filter of "tcp.analysis.flags", not a single
> packet is displayed.

That sound like tcp analysis is turned off, could you have a look at
your TCP protocol preferences?

> This same version of Wireshark *is* displaying dupe ACK's and
> retransmissions, etc., for a *different* trace file, so it appears that
> Wireshark's non-reporting of these conditions is related to this
> particular trace file.

The same *version* or *this instance of wireshark on this particular
system*?

> I've included a Wireshark screenshot, in case it's helpful.  I can strip
> down the PCAP to a small file, and send it, if that is also desired.

Please don't send screenshots to the list, they are big and provide much
less information that a small pcap file.

Cheers,
    Sake