3

With tcpdump, I am dumping traffic going out of and coming in from a wifi interface.

Are wifi retransmissions captured by tcpdump?

I am measuring the round-trip time of packets, so knowing this would greatly affect my measurements.

Ricky Robinson
  • 21,798
  • 42
  • 129
  • 185

3 Answers3

2

It is indeed possible to use Wireshark to monitor for retransmissions as mentioned here. But it probably depends on which machine you do the sniffing - a sending host may not make the retransmitted frames available to Wireshark running on that machine as they may be handled directly by the Wi-Fi card. However if the packets were monitored on another machine then you should see them. For more info on retransmissions see this question/answer.

Generally to see link layer interactions you will need to utilise Monitor mode capture and may need to play with the WLAN Interface Settings, such as Promiscuous mode (some cards need Promiscuous mode on, whilst others need it off to capture traffic).

It is possible to filter for link-layer retransmissions in Wireshark using the following filter:

wlan.fc.retry == 1
Pierz
  • 7,064
  • 52
  • 59
1

According to this link TCP Timeout and Retransmission retransmissions are also captures.

Take a look at Figure 21.1: tcpdump output

MikroDel
  • 6,705
  • 7
  • 39
  • 74
  • Oh but I wasn't talking about TCP retransmissions, which are of course always captured. I meant *wifi* retransmissions. My guess is that `tcpdump` lies somewhere between IP and Layer 2, but I just wanted to be sure of it. For instance, with Ethernet at layer 2, `tcpdump` is not at all aware of any fragmentation of IP frames into 1500-Byte chunks (basically, when an IP frame is larger than 1500 Bytes, tcpdump reports an Ethernet packet with still the original IP Frame, whereas in reality it got fragmented into two Ethernet packets). – Ricky Robinson Jul 22 '13 at 10:40
  • You automatically got the bounty, but didn't reply to my original question. ;) I inadvertently pressed on "this answer is useful" and then waited too long to cancel it. Well, no big deal anyway :) – Ricky Robinson Jul 30 '13 at 16:00
  • if no one earn full point - than half of points earn the person with most upvotes - minimum 2 upvotes – MikroDel Jul 30 '13 at 16:41
  • Yeah, sure. :) It's just that you gave me a nice and detailed answer but you misinterpreted my question :D No worries anyway :) – Ricky Robinson Jul 30 '13 at 16:59
  • @RickyRobinson - ok - I ll try to be better – MikroDel Jul 31 '13 at 05:53
  • @RickyRobinson if you will find the solution - you can post it here and accept – MikroDel Jul 31 '13 at 05:53
  • Of course! But really, no hard feelings :) I haven't tested it extensively, but after a few trials my impression is that tcpdump isn't aware of anything happening when layer 2 *really* transmits a packet. I am sending packets that trigger ICMP packets and I didn't notice anything odd over wifi. I will update you soon :) – Ricky Robinson Jul 31 '13 at 11:59
-1

As far as I know, there is no wifi re-transmission at the physical link layer. It does however check for interference signal before initiating transmission. When there is a strong interference signal on the same channel detected, transmission is deferred. However, if an interference signal comes in during transmission and cause error, the error is detected as packet lost or corrupted packet at the data link layer. So I think you should be able to capture all re-transmission using wireshark and I suppose tcpdump as well.

Bernard Wei
  • 202
  • 2
  • 5
  • 1
    of course there are retransmissions in 802.11 (wifi). Upper layers are not aware of this, otherwise well... it would elude the reason why layers are there. :) – Ricky Robinson Jul 28 '13 at 17:57
  • Just noticed that this may give reader false impression that retransmission happens at physical layer. I want to re-state that there is no retransmission mechanism at the physical layer. The lowest OSI layer where wifi retransmission happens is at the data link layer, and upper layer may not see data link layer retransmissions. See https://www.cnrood.com/en/media/solutions/Wi-Fi_Overview_of_the_802.11_Physical_Layer.pdf for more details on wifi physical layer and tranmitter. – Bernard Wei Jul 24 '19 at 19:15