1

I'm using Wireshark to monitor network traffinc to test a new software installed on a router. The router itself lets other networks (4g, mobile devices through usb etc) connect to it and enhance the speed on that router.

What I'm trying to do is to disconnect the connected devices and discover if there are any packet losses while doing this. I know I can simply use a filter stating "tcp.analysis.lost_segment" to track down lost packets, but how can I eventually isolate the specific device that causes the packet loss? Or even know if the reason was because of a disconnected device when there is a loss?

Also, what is the most stable method to test this with? To download a big file? To stream a video? Etc etc

All input is greatly appreciated

Vegard
  • 101
  • 3
  • 8

1 Answers1

2

You can't detect lost packets solely with Wireshark or any other packet capture*. Wireshark basically "records" what was seen on the line. If a packet is lost, then by definition you will not see it on the line.

The * means I lied. Sort of. You can't detect them as such, but you can extremely strongly indicate them by taking simultaneous captures at/near both devices in the data exchange... then compare the two captures.

COMPUTER1<-->CAPTURE-MACHINE<-->NETWORK<-->CAPTURE-MACHINE<-->COMPUTER2

If you see the data leaving COMPUTER1, but never see it in the capture at COMPUTER2, there's your loss. (You could then move the capture machines one device closer on the network until you find the exact box/line losing your packets... or just analyze the devices in the network for eg configs, errors, etc.)

Alternately if you know exactly when the packet was sent, you could not prove but INDICATE its absence with a capture covering a minute or two before and after the packet was sent which does NOT have that packet. Such an indicator may even stand on its own as sufficient to find the problem.

Smithers
  • 136
  • 4
  • Depending on what sort of router you are testing and what you have, you might just use a constant ping with a very large packet size to/from this device as well. If you want to get down to it, you could use different ping payloads as well. – Smithers Aug 07 '14 at 23:08