Ask Your Question
0

Does wireshark consider vlan ID before flagging a packet as TCP re-transmission

asked 2018-09-17 03:05:15 +0000

Shadowsfx45 gravatar image

updated 2018-09-17 03:07:25 +0000

Hi All

I have setup when the packet flows via a same trunk port twice with different VLAN ID. When I do a packet captures and view it on wireshark. Wireshark flags the packet as TCP Re transmission / out of order packet.

So my question is does wireshark consider the VLAN tag on the packet before flagging it as tcp retransmission.

I am not able to upload the file here as I don't have enough points.

Thanks for any help.

edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by ยป oldest newest most voted
1

answered 2018-09-17 08:06:45 +0000

Jaap gravatar image

updated 2018-09-17 11:24:48 +0000

No, it does not, it assumes that the frames captured in a file belong to a single network. Any network segmentation on top of that (being interface, VLAN, MPLS labels, etc) is not considered. It's an old issue (see bug 4561, but it should be considered beyond the scope of TCP/IP over VLAN alone. It requires a more general solution.

edit flag offensive delete link more

Comments

Thanks for the clarification.

Shadowsfx45 gravatar imageShadowsfx45 ( 2018-09-17 11:29:22 +0000 )edit

Note that there is a Wireshark preference that is intended for this purpose but that isn't fully implemented. If you look under Edit -> Preferences -> Protocols, you will see an option to Enable stricter conversation tracking heuristics. As the tooltip states, Protocols may use things like VLAN ID or interface ID to narrow the potential for duplicate conversations. Currently only ICMP and ICMPv6 use this preference to add VLAN ID to conversation tracking. So what's needed here is for developers to contribute patches in order for all other protocols to make use of things like the VLAN ID in conversation tracking as well.

cmaynard gravatar imagecmaynard ( 2018-09-17 13:49:06 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2018-09-17 03:05:15 +0000

Seen: 861 times

Last updated: Sep 17 '18

Related questions

Random Flooding of TCP Retransmissions

Why this is not a "TCP previous segment not captured"

Please explain this TCP Retransmission Sequence

Frames above 2000 bytes not acknowledged by receiver

TCP Retransmission requests from IPTV Server and TCP Dup Ack Requests from Client

What kind of request most likely comes after this package?

Seeing TCP out of order in the outgoing packets

How does wireshark determine if a TCP packet is out-of-order?

Why there is port mismatch in tcp and http header for port 51006. Also why the netstat in server do not shows connections under port 51006 even traffic is coming to this port.

Client is waiting for FIN flag from server for 30 sec