This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP packets captured twice

0

Hello,

I trying to debug some slowness on an application. Even if I think that these slowness are not related to an issue on network, I saw some strange behavior on TCP retransmission.

I got a lot of duplicate ACK and TCP retransmission in the dump. While looking deeper in packets (heavy server response), I noticed that duplicate packets have same sequence number (quite normal) but are captured exactly at the same time.

It could have been a bug during capture but this behavior does not happen on each packet.

Dump is take on a citrix client.

Does sombody have an explanation?

asked 12 Jul '14, 05:23

kireito's gravatar image

kireito
11113
accept rate: 0%


One Answer:

2

If the ip.id is the same in both packets, then the packet was just traced twice. You could 'dedup' the trace using editcap -d infile outfile

Regards Matthias

answered 13 Jul '14, 01:42

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

Thank You for the answer. The dedup on the file has resolved some problems but not all.

In fact packet are flag with interface id 0 and some other with interface id 1.

Now I got a dump from server side, witch is more cleaner. This doesn't resolv my slowness problems but it's possible to troubleshoot.

(16 Jul '14, 14:17) kireito