There is an FAQ that covers the TCP
checksum errors: http://www.ethereal.com/faq.html#q11.1
“TCP Previous segment lost”
errors are not “fatal” errors. They simply indicate that the
sequence number in the arriving packet is higher than the next-expected
sequence number, indicating that at least one segment was dropped/lost. The
receiving station remedies this situation by sending duplicate ACKs for each
additional packet it receives until the sender retransmits the missing
packet(s). TCP is designed to recover from this situation, which is why the
image is downloaded correctly despite having a (briefly) missing packet.
If you are getting a large number of lost
packets, then there is likely a communication problem between the sender and
receiver. A common cause of this is un-matched duplex settings between the PC
and the switch.
Andrew
-----Original Message-----
From:
ethereal-users-bounces@xxxxxxxxxxxx
[mailto:ethereal-users-bounces@xxxxxxxxxxxx] On
Behalf Of Blake Young
Sent: Friday, February 24, 2006
1:56 PM
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] TCP
Previous segment lost
We (our lab) recently upgraded to Ethereal
0.10.14 with WinPCap 3.1. If I remember correctly, we had previously been
using 0.10.2 with WinPCap 3.0. However, since the upgrade we have been
noticing several issues.
The first issue is with "TCP Previous segment
lost" and "TCP CHECKSUM INCORRECT" messages appearing in the
Packet Listing window. We do not remember seeing these in the previous
version of Ethereal, or at least not nearly as many as we are seeing now.
For example, one task for the student instructional part of the lab involves
visiting a website containing two images and observing the network
activity. After the two GET requests are sent for the images, it is not
uncommon for one image to be returned with a typical 200 OK response packet,
but the response packet for the other image will be displayed as "TCP
Previous segment lost." However, both images are downloaded and
displayed perfectly fine in the browser. I would think that the segment
lost error would mean the object wasn't returned correctly and shouldn't be
able to be displayed, but apparently that is not the case. (The cache had
been cleared when this was performed, so it was not defaulting to a local copy
of the image.)
Another problem we've been noticing is that some
packets simply aren't displayed in the Packet Listing window, even when they
are obviously received. Using the same example as above, after the two
GET requests are sent for the images, it is not uncommon for one image to be
returned with a typical 200 OK response, but the other response will not
appear. Yet both images are successfully displayed in the browser.
Is this a problem with Ethereal not detecting the packets?
I'm not sure how typical this is, but we seem to be
experiencing these issues often with 0.10.14 while we never did with
0.10.2. Could it also be an issue with WinPCap, and not necessarily
Ethereal? I'm just trying to find some answers as to why we are seeing a
sudden abundance of TCP related errors and uncaptured packets. Thanks.
