Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I tried to follow a TCP stream in wireshark, I found some duplicate packets. I wanted to know whether wireshark excludes duplicate(or retransmission) TCP packets from the "follow TCP stream" output.

If not, how to avoid displaying duplicate packets when I follow a TCP stream? I used Wireshark version 1.2.7

I wanted to differentiate whether the actual data I passed is duplicated , or what I see is the retransmission packet of TCP.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Recent versions of Wireshark follow the TCP specification correctly, i.e. retransmitted packets with the same TCP sequence number only show up once (with the first one where the checksum works being the one that takes precedence).

The most likely thing is that your application is sending the data more than once, and so Wireshark is correctly showing it twice.

share|improve this answer
    
Yes. I was duplicate in application data packet. By the way I found this "editcap -d" to eliminate TCP duplicates. –  Lunar Mushrooms Mar 8 '12 at 6:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.