Re: MEGACO - calculate packet retransmissions

[<joseph.kaye () cox net>]

Jaap

Try this. have had to do this frequently looking at video streams

Highlight a packet in the stream, Right Clikc it and do a Follow TCP Stream.
I usually look only on one direction at a time
so filter "ip.src == x.x.x.x"
Once done add this to the filter 
"ip.src == x.x.x.x and tcp.analysis.retransmission"
apply it, go to Statistics - Summary and under traffic displayed packets you will see a count of the retransmissions.

Alternatively if you just do the tcp.analysis.retransmission and go to Statics - Summary you can see the number of 
counted packets.
They are also on the status line at the bottom. If you are using the latest version click the expert button on the bar 
in the lower left corner, probably yellow if you applied the filter and you can gather some more info about the 
retransmissions.

Joe
---- Jaap Keuter <jaap.keuter () xs4all nl> wrote: 
> Hi, 
>
> Tshark the file, output whatever you need, then script your
> statistics. 
>
> The Wireshark site provides several presentations (from
> SharkFest et al.) about this. 
>
> Thanks,
> Jaap 
>
> On Fri, 23 Jul 2010
> 15:40:21 +0300, Manolis Katsidoniotis  wrote:  
>
> Ssending again because
> I'm not sure if the 1st one made it
>
> Hello 
>
> I have an H.248 (MEGACO)
> trace capturing traffic between a controller and a remotelly located
> gateway.
> The sniffer is located at the controller side and contains
> about 200.000 packets.
>
> It looks like some of them are retransmissions.
>
> Wireshark does not recognise the retransmission (no indication in the
> packet details) so the packet is displayed as normal.
> The way to
> recognise it is that 2 frames sent within a few seconds interval are
> identical (also same transaction id).
>
> I would like to count these
> retransmissions but I can find no obvious way through filtering or
> statistics excluding of course counting the packet one by one.
>
> Any
> ideas anyone?
>
> thanks
> Manolis
>
>  

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe