Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I am a beginner in Wireshark, and I would like to find some problems with a TCP connection. Basically, I have some sockets timing out, and I would like to find out if the message (packet) being sent has been lost.
Is Wireshark the right tool for this purpose?
Yes, you can use wireshark (and/or tcpdump) for this.
I would run wireshark on both source and destination hosts, with a capture filter for the traffic you are interested in, and then check if the traffic is actually sent and if the same traffic is received at the other host.
You can also use Iperf.
Iperf is a tool to measure the bandwidth and the quality of a network link.
One machine configured as Client and the other one as Server.
Configuration is as it follows:
Server side:
iperf -s
Client side:
iperf -c xxx.xxx.xxx.xxx // where xxx.xxx.xxx.xxx is the server's IP address.
You can also specify TCP window size.
"I have an application that spawns processes that communicate with each other through TCP using the loopback interface on the same host. Just standard TCP sockets."
For TCP connections over loopback, packet loss is exceptionally rare except under massive overload, and depends on the OS. I'd certainly look elsewhere.
Sockets timing out on loopback is much more likely to be a programming error. Details of which depend on exactly what phase of connection the sockets are timing out.
PS. Yes, for two hosts communicating and you suspect packet loss, wireshark/tshark/tcpdump is the right tool; ideally capture on both server and client, then you actually see the lost packet on one but not the other.
PPS. But almost always it's best to make a guess about what kinds of packets are getting lost. "All those of a certain size?" is especially common. If it's really just random packet loss, some of the lesser-used options of ping at one end and tcpdump/whatever at the other will often do it. Otherwise, netcat can be very useful, and as another noted, iperf.
