Wireshark-bugs: [Wireshark-bugs] [Bug 8173] Exported TCP packet with invalid sequence number not
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 08 Jan 2013 17:05:39 +0000

Comment # 3 on bug 8173 from 
Q: is this a packet replay injection or something ?

The transmitted frames starting at 1700 seem to match those originally sent at
170. Same TCP src port and same data (based upon a very quick sampling).

That being said, I see that the first connection was terminated (at frames
1673-1676) before a new connection was established (at frames 1697-1699) so it
appears that the "suspected retransmissions" aren't really such.

The tcp code has some logic to handled "re-used ports" but I'm not familiar
with its inner working.

To answer your original question: Wireshark can only determine retransmisions
based upon the contents of the capture.

The exported data contains only frames from the second connection so obviously
Wireshark doesn't see them as retransmitted since the original frames aren't in
the exported capture.

You are receiving this mail because:
  • You are watching all bug changes.