Wireshark-users: Re: [Wireshark-users] Counting the number of duplcate packets

From: Steve Evans <sc_evans@xxxxxxxxx>
Date: Fri, 4 Sep 2009 14:39:49 -0700 (PDT)

Hi Guy,

By duplicate packet, I mean packets with the same seq number in succession. In this context, 7 duplicate packets in succession (retries) = 1 dropped packet.

I display the number of counted packets matching this query by creating some sort of filter that generate the results at the bottom by stating "number of displayed packets". Of course there must be a better way to see the results.

--- On Fri, 9/4/09, Guy Harris <guy@xxxxxxxxxxxx> wrote:

> From: Guy Harris <guy@xxxxxxxxxxxx>
> Subject: Re: [Wireshark-users] Counting the number of duplcate packets
> To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
> Date: Friday, September 4, 2009, 2:45 PM
> 
> On Sep 3, 2009, at 9:39 PM, Steve Evans wrote:
> 
> > I'm looking for a display filter that will count the
> number of  
> > duplicate packets.
> 
>     1) What is your definition of a
> "duplicate packet"?  Same frame  
> content?  Same IP identifier for IP packets?
> 
>     2) Display filters do not have any state
> - they just test various  
> fields in the packet or calculated by dissectors for the
> packet - and  
> don't count things, so a display filter couldn't do this;
> another  
> mechanism would have to be used.
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>          
>    mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>