 | 1 | initial version |
There are some indicators that may help, depending on what the protocols in use are. If you're looking for packet loss in TCP conversations you'll see that Wireshark will mark some packets as "previous segment not captured" followed by "Duplicate ACKs" from the other side, and finally a "retransmission". For UDP or other protocols its not that easy and requires deeper knowledge about how the application protocols work.
I have to add that Wireshark may show "previous segment not captured" messages even when there is no packet loss on the network, so make sure that you look for the other messages as a result as well. Isolating TCP connections is advised to avoid confusing packets from multiple TCP sessions with each other. Easiest is to use "Follow TCP Stream" from the popup menu; more advanced users often use conversation filters instead.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
