Wireshark-users: Re: [Wireshark-users] Counting the number of duplcate packets
From: Guy Harris <[email protected]>
Date: Fri, 4 Sep 2009 17:19:45 -0700
On Sep 4, 2009, at 2:39 PM, Steve Evans wrote:

By duplicate packet, I mean packets with the same seq number in succession.
To what sequence number are you referring?  TCP sequence number?   
802.11 sequence number?  Some other sequence number?
In this context, 7 duplicate packets in succession (retries) = 1 dropped packet.
I display the number of counted packets matching this query by  
creating some sort of filter that generate the results at the bottom  
by stating "number of displayed packets". Of course there must be a  
better way to see the results.
So do you want the number of dropped packets, or the number of  
duplicate packets?
Again, filters don't count anything, so a filter, by itself, won't  
suffice; at best, there could be a "duplicate packet" field added to  
packets that the dissector considers duplicates, and you could filter  
on that field and see how many packets are displayed, but
	1) that doesn't just give you a count


2) that gives you a count of *duplicate* packets, not *dropped* packets.
A tap for whichever protocol has the sequence number in question would  
probably be the way to get that statistic, but it involves writing  
code.  It might be possible to write the code in Lua, if the version  
of Wireshark you're using is built with the Lua interpreter.