Ask Your Question
0

TCP SACK analysis best practice?

asked 2025-04-24 12:39:01 +0000

NJL gravatar image

Hi all,

I'm curious how others analyse captures with packet loss and subsequent SACKs.

What (tools) do you use to track the relationship between retransmissions and SACK LE / RE?

With repeated packet loss, retransmissions and SACKs in a capture with long'ish RTT I find it very very hard to keep track of what's been correctly received and what's still missing. It's an incredibly slow and painstaking process at best.

So far I haven't found any built-in way of doing this easily in Wireshark, but if such workflows exists, please enlighten me.

If other standalone tools are able to showcase this graphically or in some other more intuitive way, I'm also keen on hearing about it.

Thanks, Niels

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2025-04-24 14:26:11 +0000

SYN-bit gravatar image

Hi Niels, did you check the TCP streamgraph (tcptrace version)? It shows SACK blocks in red lines and they align to the missing packets and retransmitted packets. Indeed, long RTTs can make this process harder...

image description

edit flag offensive delete link more

Comments

Hi Sake,

I did check and it does help, but I still feel like I'm missing details. I was just hoping I was missing some obvious tool as I've been away from packet analysis for a few years. Previously I used Riverbed Cascade Pilot which seems to be dead and buried.

NJL gravatar imageNJL ( 2025-04-25 10:56:33 +0000 )edit

There might be other tools out there, but I think this is the best Wireshark can do for "easy" SACK analysis. The rest needs to be done by hand I guess.

As for Riverbed products, the name is dead-and-burried, but the products are still there. Piliot is now called "Riverbed Packet Analyzer Plus" as far as I know... and the capture appliances are also rebranded,,,

SYN-bit gravatar imageSYN-bit ( 2025-04-25 11:40:50 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2025-04-24 12:39:01 +0000

Seen: 31 times

Last updated: yesterday