Traffic was captured by Flowmon Packet Investigator and analyzed in Wireshark using filter for TCP retransmissions. Move your mouse cursor on picture below to see the difference. Number in two packets is the same, but Identification is different, we are talking about TCP retransmission. First is Sequence Number from TCP header (layer 4) and second is Identification from IP header (layer 3). So how is TCP retransmission identified? There are two parameters we need to focus on to determine whether TCP retransmission occurred. Retransmissions are essentially identical with Automatic Repeat Request (ARQ) and ensure reliability of TCP connection by resending damaged or lost packets. Packets, we are talking about TCP retransmission. When an ACK is not received, sender resends the packets after particular interval.

In TCP connection sender waits for an ACK for the byte-range sent to the receiver. Let me firstly explain principle of TCP retransmissions. Look at TCP retransmissions, a new metric added to improve Network Performance Monitoring. solution allows measuring various network metrics, which can help administrator to identify and troubleshoot network related issues. Both Mac & Matt are currently studying for their final CWNP exam – CWAP! And have been making notes and tips along the way so we wanted to share some with you guys.Ī lot of these Wireshark filters below we got from the guys over at CTS but we have added a few more that we have found useful and we will keep adding along the way of our journey!

Wireshark retransmission filter