How to filter out TCP retransmissions

asked 2017-11-17 15:58:21 +0000

Zahra
5 ●4 ●5 ●8

I have the tcp and ip header of some captured traffic as follow:

1510103571.963031 MAC1> MAC2, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 39321, offset 0, flags [DF], proto TCP (6), length 60)
    ip1.43020 > ip2.443: Flags [S], cksum 0x6d38 (incorrect -> 0x742d), seq 373163901, win 65535, options [mss 1460,sackOK,TS val 6528740 ecr 0,nop,wscale 6], length 0

How can I filter out tcp retransmissions packets?

answered 2017-11-17 16:11:22 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

You can try the Wireshark (and tshark) display filter !(tcp.analysis.retransmission or tcp.analysis.fast_retransmission).

You can't use capture (BPF) filters as they have no knowledge of previous transmissions.

edit flag offensive delete link

Comments

The captured traffic isn't in the readable format of the Wireshark. I have just the header of the captured traffic as the sample above. How can I filter out TCP retransmission myself using the header information?

Zahra ( 2017-11-17 16:40:14 +0000 )edit

There is no direct flag transmitted on the wire in the tcp header saying it's a retransmission, it's inferred by sequence number analysis.

You'll have to do tcp reassembly and note when a sequence number is retransmitted.

grahamb ( 2017-11-17 16:47:09 +0000 )edit

could you help me with it? how should I check them myself?

Zahra ( 2017-11-17 20:54:25 +0000 )edit

Have a look at this SharkFest presentation from @Jasper on tcp analysis.

grahamb ( 2017-11-17 22:33:51 +0000 )edit

Thanks @grahamb - but better use the PPT instead, because it has the animations: https://sharkfest.wireshark.org/asset...

Jasper ( 2017-11-17 23:01:05 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

How to filter out TCP retransmissions

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

How to filter out TCP retransmissions edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

How to filter out TCP retransmissions