Ask Your Question
0

How can I visualize TFTP retransmits and/or duplicate ACKS?

asked 2019-10-01 23:56:07 +0000

Pyro_Fox gravatar image

I'm just stumped on how to visualize a TFTP issue I'm having. Overall, the latency is kind of all over the place so just graphing Data and Acks over time isn't cutting it. I really want to be able to quantify Retransmitted blocks (highlighted) and duplicated blocks (1 & 2).

Is this possible with Wireshark?

TFTP: Window Size = 8

TFTP Example

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
0

answered 2019-10-02 16:49:55 +0000

Chuckc gravatar image

Is this a PXE boot? Does it ever recover or once in this state does it fail?

"I really want to be able to quantify Retransmitted blocks (highlighted) and duplicated blocks (1 & 2)." This would be pretty easy with tshark and a shell script - grep, cut, sort, uniq, ....

Example here: https://ask.wireshark.org/question/59...

Here is an example doing it with Powershell: https://ask.wireshark.org/question/30...

edit flag offensive delete link more

Comments

Note to self: see RFC7440 - TFTP Windowsize Option (https://tools.ietf.org/html/rfc7440) and use RH/Centos for testing (https://bugzilla.redhat.com/show_bug....)

Chuckc gravatar imageChuckc ( 2019-10-03 18:12:10 +0000 )edit
0

answered 2019-10-02 08:05:03 +0000

SYN-bit gravatar image

There is no logic in the TFTP dissector to identify retransmitted blocks (yet). You could write a Lua script to do this analysis, but that is not super-straightforward either.

Since there seems to be a restransmission timer of ~2 seconds (see time delta between frame 370705 and 370706), you could use a filter to display the packets that have an excessive delta time to the previous frame in the UDP conversation. The following filter will display all the TFTP packets that were received after a 1 sec pause in the UDP stream:

tftp and udp.time_delta > 1

Which will in practice show you the first packet of each retransmitted block.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-10-01 23:56:07 +0000

Seen: 758 times

Last updated: Oct 02 '19