A slow and delayed connection may indicate that packets are lost during transmission. While a certain level of packet loss is acceptable in some scenarios, in others it can seriously disrupt the user experience, especially when streaming media. Additionally, the system may drop packets entirely to compensate for latency, and data may be lost in the process.
Here’s how to determine if these are dropped or lost packets using Wireshark so you can quickly diagnose the problem.
Dropped packages? Let’s go pick them up
When users complain about slow service or poor data transmission, it is logical to assume that packet loss is to blame. Not all lost packets are dropped, but a high drop rate can still indicate several problems. This is the process to check if you have dropped packets in Wireshark.
- Open the wireshark desktop application.
- Make sure you are in capture mode.
- Look for the status bar at the bottom of the window.
You’ll see some statistics about the packets you’ve captured here. The number next to “Discarded” will indicate if any packets were discarded. In some versions, the “Discarded” counter will only appear if Wireshark did not capture all packets.
If you are sure that some packets were dropped, but the status bar doesn’t help, look up the statistics of your dropped packets like this:
- Click “Statistics” in the menu bar.
- Select “Capture File Properties.” A new window will open.
- Under “Interfaces”, you will see “Discarded Packets”. The number below will tell you how many packets were not captured.
Even if Wireshark doesn’t capture all packets, that doesn’t mean they haven’t been transmitted. The show may simply not be able to keep up with a quick broadcast. However, it could still recognize packets that were not captured with an ACK packet, since they are smaller packets and easier to capture. Therefore, you can often identify dropped packets by looking for ACKs in the information column. The ACK tells you that the data was successfully transmitted despite the missing packet.
Lost Package Investigation
Uncaptured packets do not equal lost packets. While packets that Wireshark did not capture may still reach their destination, lost packets do not. Instead, they are usually rebroadcast and only deleted in the worst cases. To investigate lost packets on a TCP segment, you will need to take a closer look at the information column on the Capture screen.
- Choose a conversation you want to investigate and apply it as a filter. This is not required but will help you get a better overview.
- Select any of the packages.
- Click “Internet Protocol version 4” in the Details section.
- Find the ID number and right click on it, then press “Apply it as column”.
You will now be able to see the sequential identification number of each transmission. Look at the numbers to find any discrepancies. Remember that in TCP, lost packets can be retransmitted later, so even if a transmission is missing instead, it may still be there further down. You can search for it using its identification number.
Whenever a packet cannot be transferred, you will see the message “Previous Segment Not Captured” in the Information column of the next line. You can also search for lost packets in all conversations by filtering them by this error message. Type “tcp.analysis.lost_segment” in the filter bar and press Enter. You can also combine this with IP address or conversation filters by typing “and” between the two filters to get a more accurate result. Again, you can search for lost packages after determining their identification numbers.
As mentioned, TCP allows lost segments to be retransmitted later. You can use the “tcp.analysis.retransmission” filter to find your retransmissions. Searching for retransmitted packets can sometimes be more productive than searching for lost segments, since lost segments can include more than one packet, while retransmissions are inpidual packets.
Locate lost packets with Wireshark
Determining whether Wireshark lost or abandoned a packet is not always easy. It is usually not enough to look at a single metric, rather several factors must be considered. Dropped packets usually reach their destination unscathed, while too many dropped packets can lead to a poor user experience.
