Home / server / Questions / 336588
Accepted
JMW
Asked: 2011-12-02 03:29:25 +0800 CST

how to calculate packet loss from a binary TCPDUMP file

  • 772

Our connection to just one remote server on port 80 over the internet is not working properly. (From time to time it is working and sometimes not)

It must be some kind of packet loss, because from other clients there are no problems. It is just happening from one client to the remote server.

Usually, i messure packet loss with ping, but the remote server is blocking ICMP.

I made a binary TCPDUMP file. How can i see if there is packet loss?

capturing was done on the client. we do not have ssh access to the remote server.

networking tcpdump tcp

2 Answers

  1. tshark can filter retransmission, duplicate ACK, lost segment, ...

    $ tshark -r file.pcap -q -z io,stat,1,\
"COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\
"COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack",\
"COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment",\
"COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission"

    Here's a sample result:

    IO Statistics
Interval: 1.000 secs
Column #0: COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission
Column #1: COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack
Column #2: COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment
Column #3: COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission
                |   Column #0    |   Column #1    |   Column #2    |   Column #3    
Time            |          COUNT |          COUNT |          COUNT |          COUNT 
000.000-001.000                 0                0                0                0 
001.000-002.000                 0                0                0                0 
002.000-003.000                 0                0                0                0 
003.000-004.000                 0                0                0                0 
004.000-005.000                 0                0                0                0 
005.000-006.000                 0                0                0                0 
006.000-007.000                 1                2                1                0 
007.000-008.000                 3                1                0                0 
008.000-009.000                 0                0                0                0 
009.000-010.000                 1                0                1                0 
010.000-011.000                 0                0                0                0 
011.000-012.000                 0                0                0                0 
012.000-013.000                 0                0                0                0 
013.000-014.000                 1                0                0                0 
====================================================================================
    • 15
  2. Best Answer

    You can measure packet retransmits from the client to the server by counting the number of duplicate sequence numbers.

    Packet retransmits from the server to the client can be measured by counting duplicate Ack numbers.

    Note that a retransmit is triggered by more than just total loss (= timeout); if the remote machine rejects the packet, or the packet is corrupted, the local machine must also retransmit.

    • 9