Wireshark · Wireshark-users: [Wireshark-users] Packet Loss Segmentation - TCP Retransmissions

["Barry Constantine" <Barry.Constantine@xxxxxxxx>]

Hello,

 

I have been trying to use the technique to determine packet loss (ingress or egress) based off of TCP retransmissions.

 

I wrote a script that looks at the retransmission SEQ numbers and determines how many retransmitted packets had multiple occurrences of the SEQ, and how many were only seen once.  If the SEQ of the retransmitted packet was seen more than once, then the loss was on the egress side of the measurement point (and conversely for SEQs seen only once).

 

So far with experimentation, I have had varied success and suspect that the detection scheme also depends on factors such as window size, latency, etc.

 

Anyone else have experience or suggestions with this technique?

 

Thanks,

Barry