Wireshark-users: [Wireshark-users] FW: Merging files duplicate acks & retransmissions
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Keith French" <keithfrench@xxxxxxxxxxxxx>
Date: Thu, 27 May 2010 11:03:14 +0100
Sorry in my first email I forgot to state the mergecap syntax I was using. It is:-
 
mergecap -F libpcap -w merged.pcap client.pcap server.pcap
 
Where "client.pcap" & "server.pcap" are the traces from either end of the connection and "merged.pcap" is my resulting merged trace.
 
Keith French.

________________________________

From: Keith French
Sent: Wed 26/05/2010 15:32
To: wireshark-users@xxxxxxxxxxxxx
Subject: Merging files duplicate acks & retransmissions


I have two capture taken on two laptops at either end of a client/server scenario. I want to merge them to use later with the new compare feature on Wireshark's Statistics menu. Neither trace has any TCP analysis flags set, other than a few window size updates & 1 retransmission.
 
However, when I merge them with Mergecap chronologically, I end up with about 400 TCP window size updates, duplicate acks & retransmissions etc.
 
I have tried this on several different trace scenarios and get similar results. Why doe this happen?
 
Keith French.