2

I am a beginner in Wireshark, and I would like to find some problems with a TCP connection. Basically, I have some sockets timing out, and I would like to find out if the message (packet) being sent has been lost.

Is Wireshark the right tool for this purpose?

  • Is it all TCP connections on a particular host? Or communications between a pair? Or a particular service? – jonathanjo Nov 14 '17 at 12:01
  • I have an application that spawns processes that communicate with each other through TCP using the loopback interface on the same host. Just standard TCP sockets. – Bionix1441 Nov 14 '17 at 12:05
3

Yes, you can use wireshark (and/or tcpdump) for this.

I would run wireshark on both source and destination hosts, with a capture filter for the traffic you are interested in, and then check if the traffic is actually sent and if the same traffic is received at the other host.

| improve this answer | |
  • Thanks for the answer @JFL. I have a stream on a loopback interface, I am now finding different packets being sent, I assume that tcp.stream is one connection, I am checking the 3 handshake and seeing if that happens, if a sequence has not been acknowledged then it means that the packet has been lost. – Bionix1441 Nov 14 '17 at 9:26
2

You can also use Iperf.
Iperf is a tool to measure the bandwidth and the quality of a network link. One machine configured as Client and the other one as Server. Configuration is as it follows:

Server side:
iperf -s

Client side:
iperf -c xxx.xxx.xxx.xxx // where xxx.xxx.xxx.xxx is the server's IP address.
You can also specify TCP window size.

| improve this answer | |
2

"I have an application that spawns processes that communicate with each other through TCP using the loopback interface on the same host. Just standard TCP sockets."

For TCP connections over loopback, packet loss is exceptionally rare except under massive overload, and depends on the OS. I'd certainly look elsewhere.

Sockets timing out on loopback is much more likely to be a programming error. Details of which depend on exactly what phase of connection the sockets are timing out.

PS. Yes, for two hosts communicating and you suspect packet loss, wireshark/tshark/tcpdump is the right tool; ideally capture on both server and client, then you actually see the lost packet on one but not the other.

PPS. But almost always it's best to make a guess about what kinds of packets are getting lost. "All those of a certain size?" is especially common. If it's really just random packet loss, some of the lesser-used options of ping at one end and tcpdump/whatever at the other will often do it. Otherwise, netcat can be very useful, and as another noted, iperf.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.