Wireshark · Ethereal-users: Re: [Ethereal-users] traffic analysis, help please

[Brian Davidson <briankd@xxxxxxxxx>]

Okay, I see that a TCP Packet was lost, but I guess I want a fuller definition of the word "lost".  Yes, the packet might actually not be there.  Beyond that, how likely is it that the traffic was so heavy on the line that Ethereal did not have resources to capture and save it?  I need to know if "TCP Previous Segment Lost" means absolutely that it was missing, rather than "slipped past while Ethereal was busy".  Is there some other indicater in the capture file that traffic volume got high enough to affect the ability to record?

I'll next ask this question of Cisco.  Any idea what their answer will be?

Thanks,   Brian

On Thu, 26 Aug 2004 17:08:24 +1000, ronnie wrote:
> They more than likely mean that you have packetloss somewhere on the
> path between the two hosts.
>
> So that TCP needs to retransmit the packets.
> 1, is an indication of TCP retransmitting a previously dropped packet.
> 2, is an indication that one or more packet prior to this one in the
> sequence number space was lost.
>
>
> On Wed, 25 Aug 2004 11:21:03 -0500, Neil  wrote:
> > Hey guys,
> > 
> > I'm trying to understand traffic. I am seeing the following in Ethereal. Can
> > someone help me understand what those traffic mean?
> > 
> > 1. TCP Retransmission
> > 2. TCP Previous Segment Lost
> > 
> > Thanks,
> > 
> > Neil