Wireshark-users: Re: [Wireshark-users] Capture filter for tcp retransmissions

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 13 Nov 2006 10:31:58 -0800
Paul Jacobs wrote:
I found the display filter for tcp retransmissions but is there a capture
filter for this?

No - libpcap's capture filter mechanism doesn't support any form of state kept between packets; each packet is treated independently from previous packets, so it'd be impossible for the filter mechanism to know whether a packet is a retransmission.