TCP SACK analysis best practice?
Hi all,
I'm curious how others analyse captures with packet loss and subsequent SACKs.
What (tools) do you use to track the relationship between retransmissions and SACK LE / RE?
With repeated packet loss, retransmissions and SACKs in a capture with long'ish RTT I find it very very hard to keep track of what's been correctly received and what's still missing. It's an incredibly slow and painstaking process at best.
So far I haven't found any built-in way of doing this easily in Wireshark, but if such workflows exists, please enlighten me.
If other standalone tools are able to showcase this graphically or in some other more intuitive way, I'm also keen on hearing about it.
Thanks, Niels