Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2018-07-19 07:15:52 +0000

Eddi gravatar image

Hi Brad

Welcome to ask.wireshark.org. The short extract from the trace file shows a lot of duplicate frames. A good example are frames 1 and 2:

  • Same source
  • Same destination
  • Same sequence numbers
  • Same length
  • Nearly same time stamp: both packets are 2 nanoseconds apart.

A look at the IP ID in the IP header would confirm this.

Is it possible, that your capture environment delivered the same packets twice? If you have indeed captured the same packet twice Wireshark will mark this as a retransmission.

I suggest that you go through Jaspers excellent network capture playbook. If your trace file does not contain sensitive data you might be able to share it via cloudshark.

Good Luck