Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: [Ethereal-dev] TCP analysis not catching SACK retransmissions

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Morgan, Chip E." <Chip.Morgan@xxxxxxxxxx>
Date: Fri, 14 Mar 2003 11:54:24 -0500
Hi,
   I've used Ethereal's TCP analysis feature for a while now to detect TCP
retransmissions, and have been pretty satisfied with the result. However, I
have just noticed that TCP analysis does not appear to be detecting
retransmissions if Selective ACK is being used by the communicating
computers. I am assuming that SACK is the "culprit" here, but that *is* an
assumption on my part. I have validated manually within Ethereal, and also
via another protocol analyzer that retransmissions are present within some
of my captures where SACK is in use. I've tested this with all of the
Ethereal versions released since the TCP analysis feature was introduced
(including v0.9.11), with similar results. I can present captures, online or
off, to interested persons. I'd greatly appreciate it if you folks could
take a look at this as time permits.

   While I'm here, thanks again for creating and continuing to improve
Ethereal. I use the tool enough that I keep lurking on the Ethereal main
page every couple of weeks, waiting for more goodies in the latest release.

Thanks,
   Chip

Chip Morgan
Sr Designer
IT Network Systems
Norfolk Southern Corp