ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] Feature request - TCP Retransmission labeling

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 6 Aug 2003 14:11:52 -0700

On Wednesday, August 6, 2003, at 1:54 PM, ListSrv wrote:

Actually I am implementing the retransmission-feature. It should identify:
-   retransmission number
-   the framenumber of the original frame
-   delta-time of previous retransmitted frame
There  is one issue that is waiting for distribute the feature:
A retransmission can be:
- a real retransmission (SEQ is the same as in the original frame, de IP-identifer
   however is different)
- a duplicated frame (SEQ en IP-identifer are the same, but the MAC-address is
    different but de TTL is dropping (e.g. there is a routing loop)
-   none of above (e.g. router-on-a-stick).

Therefore I have to access the MAC-frames from every source en retransmitted
frame. I have not figured that one out.....:(

You're assuming there *IS* a MAC frame or a MAC address. There isn't necessarily one.

The current retransmission feature doesn't bother with all that; perhaps it's a 90% solution, but that might be good enough.

If you still want to check the IP identifier, you'd have to modify the IPv4 and IPv6 dissectors to supply it to the dissectors they call.

If you still want to check the link-layer address, you can check pinfo->dl_src and pinfo->dl_dst; do *NOT* assume that they're Ethernet-style addresses. Instead, see the "CMP_ADDRESS()", "ADDRESSES_EQUAL()", and "COPY_ADDRESS()" macros in "epan/packet_info.h".

Note also that, as per my earlier mail, a TCP retransmission can retransmit data from more than one earlier TCP segment....