Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

The "acked lost" and "acked unseen" indicate the same event:
An ACK was seen for which the segment it acknowledges is not in the capture file.
You can filter on this using either
tcp.analysis.ack_lost_segment or == "ACKed segment that wasn't captured (common at capture start)"

"previous segment not captured" means a segment was arriving out of order at the capture point.
It could have been lost or is just arriving late at the capture point. A filter on those is
Hope this helps,
regards Matthias