I run Iperf over wifi sending udp packets from a client to a server and I capture the traffic with Wireshark. The total number of datagrams captured in Wireshark is less than sent with Iperf. Based on the sequence number it should be possible to figure out which frames are missing. Does Wireshark have some kind of highlighter which could be used to help me finding the gaps or is there some other way to find it?


I'm not running a version of Wireshark with iperf support, but I've done a similar thing with esp packets, which you might find useful and which I will use to illustrate below. You will obviously need to modify the tshark command below to meet your iperf needs. I suppose the filter probably just needs to be changed from -Y "esp" to -Y "iperf2_udp" and the field to print would likely just need to be changed from -e esp.sequence" to -e iperf2.udp.sequence", but I have no way to verify and test this at the moment, so I leave that as an exercise for the reader.

In any case, there are 3 basic steps to follow:

  1. Using tshark, generate a list of all sequence numbers for the relevant flow and save it in a .csv file. In my case:

    tshark -r capture.pcap -Y "esp and ip.src eq" -T fields -e frame.number -e esp.sequence -E separator=, > esp_seq.csv

  2. Import the .csv file into Excel (or your favorite spreadsheet software) and add a heading column so it looks nicer and you know which column is which. It should look something like this:

A B C 1 Frame Seq# 2 2 7753 3 4 7754 4 6 7756 5 8 7757

  1. In cell C3, add a formula to indicate if there's a gap, and then apply that formula to every other cell in column C (except C2) by dragging the fill handle, e.g.,


You should see:

A B C 1 Frame Seq# 2 2 7753 3 4 7754 4 6 7756 Missing 5 8 7757

Credit: The Excel tip came from here, but with a slight modification to avoid the "Missing" appearing in the last row of column C.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.