Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: Re: [Ethereal-users] traffic analysis, help please

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date: Fri, 24 Dec 2004 18:28:07 +0100
On Fri, 24 Dec 2004 06:37:34 -0800, Brian Davidson <briankd@xxxxxxxxx> wrote:
>  I need to know if "TCP Previous Segment Lost" means absolutely that it was missing, rather than "slipped past while Ethereal was busy". 

Depending on the amount of traffic going through, if it's realy high
the kernel might been dropping packets.

Try capturing with tcpdump for few minutes and check whether or not
the kernel does drop some packets.
 

> I'll next ask this question of Cisco.  Any idea what their answer will be?
Either "fix your wiring" or "check processor load and if it's more
than 50% buy a faster router".
:-) 

> Thanks,   Brian
> 
> On Thu, 26 Aug 2004 17:08:24 +1000, ronnie wrote:
> >
> > They more than likely mean that you have packetloss somewhere on the
> > path between the two hosts.
> >
> > So that TCP needs to retransmit the packets.
> > 1, is an indication of TCP retransmitting a previously dropped packet.
> > 2, is an indication that one or more packet prior to this one in the
> > sequence number space was lost.
> >
> >
> > On Wed, 25 Aug 2004 11:21:03 -0500, Neil  wrote:
> > > Hey guys,
> > >
> > > I'm trying to understand traffic. I am seeing the following in Ethereal. Can
> > > someone help me understand what those traffic mean?
> > >
> > > 1. TCP Retransmission
> > > 2. TCP Previous Segment Lost
> > >
> > > Thanks,
> > >
> > > Neil
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>