Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a retransmission.

here is what wireshark shows about this session. Which packets should i use to reconstruct the session? First packets or retransmited packets? Which of them have valid datas?

I couldnt find a way to attach pcap file if you want i can upload pcap file to somewhere. Im sorry i couldnt post image to here cause i dont have enough reputation.

share|improve this question
up vote 1 down vote accepted

It doesn't matter, they should all have the same data for the same byte positions. If they differ, it's arbitrary which is 'correct'. (And, in practice, that will never happen unless someone is deliberately abusing TCP to create a back channel or the like.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.