0

Could anyone explain these errors:

TCP ACKed unseen segment
TCP Dup ACK
TCP Previous segment not captured
TCP Out-Of-Order
TCP Retransmission 
5

Seems that these are packet capture descriptions from Wireshark.

TCP ACKed unseen segment

Means that this packet acknowledges data that wasn't captured. It was transferred okay, and the receiver acknowledges it, but Wireshark can't find the packet in the capture. This usually happens when the capture device wasn't fast enough.

TCP Dup ACK answered here

TCP Previous segment not captured

If packet N is marked with previous segment not captured, it means that in the capture there is no packet from the same TCP session whose seq + length would match the seq of packet N. The most typical reason is packet loss and/or late start of capture, which is the reason why the wording in question is used. But there can eventually be other reasons (buggy TCP stack of the sender, multipath network structure allowing packets belonging to the same TCP session to pass through different network interfaces so the packets do reach their destination but Wireshark cannot see them, ...), so it is up to you to check out the real reason why this has happened in your particular case.

TCP Out-Of-Order

It simply means that particular frame was received in a different order from which it was sent (after a later packet in the sequence). It is not generally a problem. It probably indicates there are multiple paths between source and destination - and one travels a through a longer path. It means TCP has slightly more work to reassemble segments in the correct order.

TCP Retransmission

When the receiving socket detects an incoming segment of data, it uses the acknowledgement number in the TCP header to indicate receipt. After sending a packet of data, the sender will start a retransmission timer of variable length. If it does not receive an acknowledgment before the timer expires, the sender will assume the segment has been lost and will retransmit it. The TCP retransmission mechanism ensures that data is reliably sent from end to end. If retransmissions are detected in a TCP connection, it is logical to assume that packet loss has occurred on the network somewhere between client and server.

You can find more useful info about wireshark here

  • yes these are packet capture from wireshark. Thank you – Mamitiana Ra Dec 17 '18 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.