For an outgoing packet, the timestamp is when the capture mechanism.Include any transition time over the NIC. Is handed the packet from its way from the NIC to the client. For an incoming packet, the timestamp is when the capture mechanism.On the other side where the packet was sent from/to. This requires a correlated packet capture There is no way with a single capture to know how long it took for.For most purposes, focusing onĪ TCP stream, i.e. Following a stream means extracting the subset of a conversation,įrom the point of view of an application.

An endpoint is a logical endpoint of a protocol or network layer.įor most purposes, focusing on an IP endpoint, i.e.

A conversation is the set of packets between two endpoints.

Wireshark supports the packet formats of most operating systems.

upgrading to Wireshark 2.2.3 and reinstalling WinPCap 4.1.Wireshark is an open source program to perform analysis on capture.

powering off and on the HP 1820-8G switch.

My wireless connection as well as any other connections (Bluetooth, VMWare) are disabled (adapter disabled), only my LAN adapter and the USB adapter are enabled, of course.

That adapter is connected to a mirroring port of my HP 1820-8G switch.

I'm monitoring traffic on an external USB Ethernet interface which does not have an IP address.

I'm using a Wireshark display filter for HTTP.

I'm using a Wiresharp capture filter for the TCP port I'm interested in.

I see these lines with a distance of 1 second, so there's always a green line (HTTP) and a black line (TCP retransmission) or a grey line (TCP) and a black line (TCP Dup ACK).

a bug in the WinPCap driver? (Version 4.1.3).

How do I find out the source of this retransmission? Is it

Wireshark detects the second packet as TCP retransmission.the time increases by 2 microseconds (.811504000 /.the two frames have the same sequence number.Retransmitted TCP segment data (394 bytes) Sequence number: 10245 (relative sequence number) I'm observing TCP retransmissions like this: Frame 429: 448 bytes on wire (3584 bits), 448 bytes captured (3584 bits) on interface 0 I am requesting a URL (so the following happens with a HTTP GET request) from Firefox 50.0.2 and I'm using the auto refresh feature with a 1 second timeout.

Tcp retransmission wireshark filter