This event is a good indicator of packet loss and will likely be accompanied by 'TCP Retransmission' events. TCP Previous segment lost - Occurs when a packet arrives with a sequence number greater than the 'next expected sequence number' on that connection, indicating that one or more packets prior to the flagged packet did not arrive. TCP_Out-of-order - Occurs when a packet is seen with a sequence number lower than the previously received packet on that connection. Senders should Fast Retransmit upon receipt of 3 duplicate ACKs. Senders receive some packets which sequence number are bigger than the acknowledged packets. TCP Fast Retransmission - Occurs when the sender retransmits a packet before the expiration of the acknowledgement timer. TCP Retransmission - Occurs when the sender retransmits a packet after the expiration of the acknowledgement. When this feature is enabled the sliding window monitoring inside Wireshark will detect and trigger display of interesting events for TCP such as : This feature should not impact too much on the run-time memory requirements of Wireshark but can be disabled if required. This allows much better and more accurate measurements of packet-loss and retransmissions than is available in any other protocol analyzer.

This requires some extra state information and memory to be kept by the dissector but allows much better detection of interesting TCP events such as retransmissions. See the TCP Analysis section of the User's Guide for more up to date documentation.īy default Wireshark and TShark will keep track of all TCP sessions and implement its own crude version of Sliding_Windows.

Wireshark tcp retransmission