FW: Merging files duplicate acks & retransmissions

["Keith French" <keithfrench () btconnect com>]

Sorry in my first email I forgot to state the mergecap syntax I was using. It is:-
 
mergecap -F libpcap -w merged.pcap client.pcap server.pcap
 
Where "client.pcap" & "server.pcap" are the traces from either end of the connection and "merged.pcap" is my resulting 
merged trace.
 
Keith French.

________________________________

From: Keith French
Sent: Wed 26/05/2010 15:32
To: wireshark-users () wireshark org
Subject: Merging files duplicate acks & retransmissions


I have two capture taken on two laptops at either end of a client/server scenario. I want to merge them to use later 
with the new compare feature on Wireshark's Statistics menu. Neither trace has any TCP analysis flags set, other than a 
few window size updates & 1 retransmission.
 
However, when I merge them with Mergecap chronologically, I end up with about 400 TCP window size updates, duplicate 
acks & retransmissions etc.
 
I have tried this on several different trace scenarios and get similar results. Why doe this happen?
 
Keith French.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe