Comment # 3
on bug 8173
from Bill Meier
Q: is this a packet replay injection or something ?
The transmitted frames starting at 1700 seem to match those originally sent at
170. Same TCP src port and same data (based upon a very quick sampling).
That being said, I see that the first connection was terminated (at frames
1673-1676) before a new connection was established (at frames 1697-1699) so it
appears that the "suspected retransmissions" aren't really such.
The tcp code has some logic to handled "re-used ports" but I'm not familiar
with its inner working.
To answer your original question: Wireshark can only determine retransmisions
based upon the contents of the capture.
The exported data contains only frames from the second connection so obviously
Wireshark doesn't see them as retransmitted since the original frames aren't in
the exported capture.
You are receiving this mail because:
- You are watching all bug changes.