Ask Your Question

Does wireshark consider vlan ID before flagging a packet as TCP re-transmission

asked 2018-09-17 03:05:15 +0000

Shadowsfx45 gravatar image

updated 2018-09-17 03:07:25 +0000

Hi All

I have setup when the packet flows via a same trunk port twice with different VLAN ID. When I do a packet captures and view it on wireshark. Wireshark flags the packet as TCP Re transmission / out of order packet.

So my question is does wireshark consider the VLAN tag on the packet before flagging it as tcp retransmission.

I am not able to upload the file here as I don't have enough points.

Thanks for any help.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-09-17 08:06:45 +0000

Jaap gravatar image

updated 2018-09-17 11:24:48 +0000

No, it does not, it assumes that the frames captured in a file belong to a single network. Any network segmentation on top of that (being interface, VLAN, MPLS labels, etc) is not considered. It's an old issue (see bug 4561, but it should be considered beyond the scope of TCP/IP over VLAN alone. It requires a more general solution.

edit flag offensive delete link more


Thanks for the clarification.

Shadowsfx45 gravatar imageShadowsfx45 ( 2018-09-17 11:29:22 +0000 )edit

Note that there is a Wireshark preference that is intended for this purpose but that isn't fully implemented. If you look under Edit -> Preferences -> Protocols, you will see an option to Enable stricter conversation tracking heuristics. As the tooltip states, Protocols may use things like VLAN ID or interface ID to narrow the potential for duplicate conversations. Currently only ICMP and ICMPv6 use this preference to add VLAN ID to conversation tracking. So what's needed here is for developers to contribute patches in order for all other protocols to make use of things like the VLAN ID in conversation tracking as well.

cmaynard gravatar imagecmaynard ( 2018-09-17 13:49:06 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-09-17 03:05:15 +0000

Seen: 739 times

Last updated: Sep 17 '18