« Live Webinar and Survey Reveals Wireless Secrets | Main | Pilot Sneak Preview: A New Direction in Network Analysis? »

March 11, 2008

Comments

Ronnie Sahlberg

Cool Stuff,

We didn't do that bad! (I wrote the TCP analysis part of wireshark).

Retransmissions are somewhat tricky to analyze in a capture, in particular since in a capture file you also have to assume that there were missing segments. (the capture missed some packets that were actually on the wire).

Wireshark tries to classify retransmissions into three distinct classes:
1, "normal" retransmissions
2, Fast retransmissions
3, (not really retransmissions) out-of-order packets if the network path doesnt guarantee time-integrity and reorders packets.

I think it does an ok job. Not perfect but reasonable.

Want to try something a bit harder?

If you want to test with something a bit more challenging (I would be plesantly surprised if the other tools can also do this)
please have a look at the capture I created for you at

http://samba.org/~sahlberg/zero-window-solaris.cap.gz


This trace shows a solaris client sending data to a server. Eventually the server application hangs (SIGSTOP) and the advertized window fills up completely.

Packet 131 shows the final packet when the advertised window has been completely filled and the client must stop. Do the other tools mark this packet as "WindowFull" or equivalent? It would be interesting for me to know.

After this there are just a bunch of ZeroWindow probes (wireshark assumes a packet is a zero window probe IF the window is full and IF the segment contains exactly one byte of data and IF this byte of data is immediately to the right of the right edge of the window)

You can also have a look at
http://samba.org/~sahlberg/zero-window-linux.cap.gz
which shows the same thing but for a linux client.
Note that the linux stack does not technically use ZeroWindow probes but instead just issues KeepAlive packets (0 or 1 byte of random data immediately prior to the left edge of the window).
The purpose and end result is the same but it is technically speaking not ZeroWindow probes.

ronnie s

The comments to this entry are closed.