[Winpcap-users] TCP Retransmission

ceo ceo at triplebit.com
Wed Oct 24 21:16:11 GMT 2007


I use Ethereal and watch the following phenomena-
In a tcp session the sender sends from time to time a packet which is marked
as "retransmission" by the sniffer. Closer look reveals that the
"retransmitted" packet is similar to the previous one but contains a few
more bytes.
My questions-
1. How does the sniffer software know that its a retransmission?
2. The retransmitted packet is sent before the receiver acked the previous
packet or reacted to it whatsoever, so why did the sender retransmitted it
at all?
3. How does the receiver treats the 2 packets, does he neglect any of them?

Regards

I. Lesher




More information about the Winpcap-users mailing list