CODEWITHSUNDEEP
wireshark
Samira Afzal
Samira Afzal

Reputation: 49

wireshark analysis for packet loss

I have a network like below. I captured pcap over node1 interface. I was checking pcap's statistics. My question is that when i get "tcp.analysis.lost_segment" , Does it mean these packets are lost through node0 to node1 (path1 +path2) or these lost packets happened over path2?

        path1                                path2
              .................Router...............
         .                                           .
       .                                               .
node 0                                                  node1

Thanks in advance

Upvotes: 1

Views: 2596

Answers (1)

Andy70109
Andy70109

Reputation: 121

Lost segment means the corresponding TCP packet is not in your capture file. It cannot tell you exactly where the packet was lost--it could have been lost on either path1 or path2.

It can also occur for other reasons. For example: With captures on busy interfaces the pcap subsystem can drop packets--in that case the packet can actually arrive at node1 (and be delivered to the corresponding application) but won't be in your pcap file.

This is a common discussion on the list--here is one thread that might help: https://ask.wireshark.org/questions/2425/tcp-acked-lost-segment

Upvotes: 2

Related Questions