I am trying to find the number of lost packets in the network.
I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105.
In order to start Wireshark captures at the same time, I send a start command by another Device C and then stop the captures again after 5 minutes. During the capture, I sent a 300MB file from DeviceB to DeviceA over Windows file sharing, which uses TCP.
I saw that both pcap files starts with the SAME TCP packet and ends with the same TCP packet. However when I filter the capture in DeviceA with ip.src==192.168.0.105, I receive 165.367 packets. When I apply the same filter in DeviceB, I receive 163.315 packets. Meaning that DeviceA says it received more packets than the DeviceB has sent.
DeviceA pcap has 19468 NBSS packet, however DeviceB pcap has 73629 NBSS packet. How is that possible, is this a normal behaviour or am I missing something?