Wireshark-users: [Wireshark-users] Comparing packets
From: Piers Kittel <debian@xxxxxxxxxx>
Date: Tue, 22 May 2007 16:27:42 +0100
Hello all,

Part of my job is to monitor the quality of packet transfer between two video devices. I was given a DVD full of capture files. Essentially, there were 2 computers between 2 video devices talking to each other, i.e:

device A <--> computer A <--> modem A <--> Internet <--> modem B <--> computer B <--> device A

So, the computers were run at the same time to capture the packets going between device A and B. I've got 2 files, like A-20070522-162040.gz and B-20070522-162040.gz. I've merged the two, and filtered out the packets I'm not interested in. Naturally, I see double of nearly all packets. What I'm interested in is to find packets that failed to reach the other side, so I'd like to filter out all packets that arrived successfully - how do I do this?

For example, I can see 3 packets:

Packet 1 has the stream: 00 01 0a 9e 00 01 18 22 f6 49 06 57 f0 4a 81 04 60 40 42 7f a6 f9 Packet 2 has the stream: 00 01 0a 9e 00 01 18 22 f6 49 06 57 f0 4a 81 04 60 40 42 7f a6 f9 Packet 3 has the stream: 80 00 4e 08 dd 55 96 21 b5 54 fd 46 d1 b3 e5 56 f5 43 d6 3e 7c a4

Packet 4 failed to arrive however. How do I filter out Packets 1 and 2 but not 3?

Thanks very much for your help in advance!

Regards - Piers