I have a SPAN on two different switch ports which are going to the same sniffer. Host A's connecting port is SPANed, and host B's connecting port is SPANed as well. Because it's a router on a stick type of configuration, I was hoping that during a time that communication failures are reported from application logs, I can look for a particular packet on both sides. I see in my trace that there are a massive amount of retransmissions, and I am curious if Wireshark's logic marks anything as a retransmission if it sees it twice?
Does anyone have any tips on when they are tracing something like this?
Thanks
Best Answer
Wireshark stores the sequence number for a given TCP flow. If the new packet does not advance the sequence number, then it marks it as a retransmission.
This is the actual Wireshark code in
epan/dissectors/packet-tcp.c
(included inline below).Please look at the
tcp_analyze_sequence_number()
function, more specifically the block starting at line 822.Line 822 of
epan/dissectors/packet-tcp.c
(Revision 33861):