Search code examples
tcpwireshark

How to identify the retransmitted TCP segment in Wireshark?


I am confused to identify the retransmitted TCP segment in the captured segments at Wireshark. Is there any notes showing that a segment is a retransmitted one in Wireshark?


Solution

  • For wireshark to identify a segment as a retransmitte one, it has to identify both packets (original and retransmitted) in the pcap file.

    If for example, you sniff on the receiving endpoint for a certain packet, you might only see the retransmitted instance (as sometimes, though not always, the retransmission would happen due to the packet not arriving to destination). In that case wireshark will only see one instance of the packet and won't know it was retransmitted.

    If you do have both packets in the pcap file (e.g. for the example above, but sniffing on the source of the packet), wireshark will identify it.

    The way wireshark marks TCP retransmissions varies between WS versions but in the later ones it will usually default to black color (and anyway you can always see in the "expert info" field under TCP).