New answers tagged wireshark
0
I found some resources about this. If you are trying to compare two pcap files in two endpoints to analyze network traffic, packet numbers may not match in both ends.
If received packet number of your receiver end is greater than the sent packet number of your sender, this may be because of GRO and LRO implementation of the NICs. Some NIC may have a feature ...
0
TCP may lose some segments when the interconnect or the destination is slower than the source - that is by design and required for congestion control. Congestion control continuously tries to ramp up the send window until packet loss is detected and then throttles it again.
0
Despite you used Device C to syncronize packet capture on both Devices it is nearly impossible to simultaneously start and stop capture, commands might reach one of the devices earlier than other one. I would recommend you to compare particular TCP sessions which can be identified by src and dst port numbers or "tcp.stream" field in Wireshark.
Top 50 recent answers are included
