How to identify packet loss from a capture

A packet capture can show evidence consistent with loss, but one trace cannot always distinguish network loss from packets missed by the capture system.

What loss looks like in TCP

TCP numbers bytes and acknowledges the next byte expected. If one segment is missing but later data arrives, the receiver repeats the same acknowledgement. The sender then retransmits the missing sequence range, either after enough duplicate ACKs or after a timeout.

A useful Wireshark starting filter is:

tcp.analysis.retransmission ||
tcp.analysis.fast_retransmission ||
tcp.analysis.lost_segment ||
tcp.analysis.duplicate_ack

These are Wireshark analysis labels, inferred from the packets available to it. Inspect them within one conversation rather than treating the global count as a loss percentage.

Investigate one flow

1. Select a marked packet and isolate its tcp.stream.
2. Find the first sequence gap or duplicate ACK.
3. Note which direction carried the missing data.
4. Measure the delay until retransmission and recovery.
5. Check whether application progress stopped during the event.

Fast retransmission after duplicate ACKs is strong evidence that later bytes reached the receiver before an earlier range. A timeout-based retransmission shows the sender did not receive adequate acknowledgement before its timer expired, but the missing item could be data or an ACK.

Use tshark for a compact event list

tshark -r capture.pcapng \
  -Y "tcp.analysis.retransmission || tcp.analysis.fast_retransmission || tcp.analysis.duplicate_ack" \
  -T fields -E header=y \
  -e frame.number -e frame.time_relative -e tcp.stream \
  -e ip.src -e ip.dst -e tcp.seq -e tcp.ack -e tcp.len \
  -e _ws.col.info

Sort or group by tcp.stream. A handful of isolated events across hours may be unimportant; repeated bursts in the same business-critical flow deserve attention.

Rule out false conclusions

• Capture drops: if the sniffer misses a packet, Wireshark sees a sequence gap even though the network delivered it.
• Asymmetric visibility: a SPAN or routed capture point may see only one direction or one path.
• NIC offload: captures taken on an endpoint can show unusually large segments or checksum warnings that did not exist on the wire.
• Reordering: a later segment can arrive before an earlier one without either being lost.
• Duplicate capture: port mirroring or aggregation can record the same packet twice.

Locate the point of loss

Capture simultaneously near both endpoints. If a data packet appears on the sender-side trace but not the receiver-side trace, while surrounding packets appear on both, the loss lies somewhere between those observation points. If it is absent from both, it may never have left the sender. If it appears at the receiver but its ACK does not reach the sender, investigate the reverse path.

Synchronised clocks help with timing, but sequence numbers and payload lengths are the more reliable way to match the same TCP data across traces.

Manual method vs PCAPNG Analyzer