Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a retransmission.

http://img412.imageshack.us/img412/4655/retransmission.png

here is what wireshark shows about this session. Which packets should i use to reconstruct the session? First packets or retransmited packets? Which of them have valid datas?

I couldnt find a way to attach pcap file if you want i can upload pcap file to somewhere. Im sorry i couldnt post image to here cause i dont have enough reputation.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

It doesn't matter, they should all have the same data for the same byte positions. If they differ, it's arbitrary which is 'correct'. (And, in practice, that will never happen unless someone is deliberately abusing TCP to create a back channel or the like.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.