 | 1 | initial version |
There is no logic in the TFTP dissector to identify retransmitted blocks (yet). You could write a Lua script to do this analysis, but that is not super-straightforward either.
Since there seems to be a restransmission timer of ~2 seconds (see time delta between frame 370705 and 370706), you could use a filter to display the packets that have an excessive delta time to the previous frame in the UDP conversation. The following filter will display all the TFTP packets that were received after a 1 sec pause in the UDP stream:
tftp and udp.time_delta > 1
Which will in practice show you the first packet of each retransmitted block.