How to find the packet loss in Wireshark?

packet wireshark packet-capture
krishnakumar picture krishnakumar · Jun 30, 2009 · Viewed 42.8k times · Source

I need to test packet loss for an FTP application. I used the Wireshark packet sniffer, and I got TCP Stream.

How do I find the packet loss using Wireshark?

Answer

AltF4 picture AltF4 · Nov 12, 2010

Packet loss and other related metrics like bit error rate (BER) can be hard or impossible to empirically see by looking at dumps in Wireshark, depending on what layer you're wanting to look at. And a lot of it is highly dependent on what protocols you're using and what software/firmware is implementing it.

I had this exact experience with Wi-Fi routers, for example. I needed to empirically test the BER of a given Wi-Fi link. But it turns out that 802.11 has a TCP-like CRC based retransmit system that all occurs at the link layer.

So, for example, you may send a UDP packet from Wi-Fi device A to Wi-Fi device B. In transit, a couple of bits get flipped, device B sees that the CRC is wrong and sends a request for retransmit. The packet gets sent again, and again gets corrupted. On the third try, though, the packet gets through fine.

From this, you would hope to see some kind of packet loss metric right? Well, unfortunately no. This whole interchange happens below Wireshark. All it sees is a UDP packet get sent successfully, but take three times as long as normal to get there. (I wound up having to make kernel modifications to send out a notice when link layer CRC errors occurred. It was a mess!)

Related questions

Follow tcp stream - Where does field "Stream index" come from?

Wireshark has a that feature called "follow tcp stream", under the menu item "Analyze". When I use it, a screen capture filter is generated, something like: tcp.stream eq 1 Where does this index come from? I can't find any field …

Read More
iPhone and WireShark

How can I sniff packets from my iPhone on my network? can someone give me some instructions? I tried Googling, but nothing teaches how to sniff iPhone packets、 I am on windows.

Read More
Capture incoming traffic in tcpdump

In tcpdump, how can I capture all incoming IP traffic destined to my machine? I don't care about my local traffic. Should I just say: tcpdump ip dst $MyIpAddress and not src net $myIpAddress/$myNetworkBytes ... or am I missing something?

Read More