Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I tried to follow a TCP stream in wireshark, I found some duplicate packets. I wanted to know whether wireshark excludes duplicate(or retransmission) TCP packets from the "follow TCP stream" output.

If not, how to avoid displaying duplicate packets when I follow a TCP stream? I used Wireshark version 1.2.7

I wanted to differentiate whether the actual data I passed is duplicated , or what I see is the retransmission packet of TCP.

share|improve this question
up vote 1 down vote accepted

Recent versions of Wireshark follow the TCP specification correctly, i.e. retransmitted packets with the same TCP sequence number only show up once (with the first one where the checksum works being the one that takes precedence).

The most likely thing is that your application is sending the data more than once, and so Wireshark is correctly showing it twice.

share|improve this answer
Yes. I was duplicate in application data packet. By the way I found this "editcap -d" to eliminate TCP duplicates. – Lunar Mushrooms Mar 8 '12 at 6:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .