Ask Your Question

Using Merge: Receiving Bad TCP Errors on Good Packets

asked 2019-08-02 18:12:09 +0000

genesiusj gravatar image

After merging two pcapng files, from two different firewalls, I am receiving Bad TCP errors. These are retransmissions; spurious retransmissions; ACKed unseen segment; Previous segment not captured; Port numbers reused; etc. Is there any way to resolve this? Using WS v3.0.2/Win 8.1.

Thanks and God bless, Genesius

edit retag flag offensive close merge delete


If both firewalls saw the same TCP segment, the merged capture will have two copies of that segment, which will look, to Wireshark, as if the segment was retransmitted. Is that what's happening?

Guy Harris gravatar imageGuy Harris ( 2019-08-02 20:56:34 +0000 )edit

Thanks Guy, Checking out the TTL's the firewalls are separated by 4 routers. Not sure if that answers your question. Thanks and God bless, Genesius

genesiusj gravatar imagegenesiusj ( 2019-08-04 19:17:44 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-08-08 14:14:54 +0000

cmaynard gravatar image

The problem is very likely that the 5-tuples are the same and Wireshark isn't taking into account additional information such as the capture interface when tracking conversations. There is a Wireshark preference to "Enable stricter conversation tracking heuristics" that could be expanded to include the interface in tracking conversations, but every protocol that tracks conversations would have to be modified to make use of it. Obviously, some protocols such as TCP would be good candidates to start with. Alternatively, the "Enable stricter conversation tracking heuristics" preference could be split into separate preferences that allow for more fine-tuning of conversation tracking.

In any case, filing an enhancement bug report on the Wireshark Bug Tracker asking for the interface to be included in conversation tracking is probably the best path for a resolution to this problem.

edit flag offensive delete link more


... and after 4 years, it seems that a bug report has finally been filed as Issue 19463 - Packets on different interfaces are listed as part of the same conversation.

cmaynard gravatar imagecmaynard ( 2023-11-03 17:33:52 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-08-02 18:12:09 +0000

Seen: 360 times

Last updated: Aug 08 '19