Hello, guys, and welcome to another video of this chapter
in this video, we're going to learn a few ways to investigate lost packets.
Well, doing network traffic analysis with Wireshark.
So once you have
fired up Wireshark and captured the desired traffic that you would like
to search for lost packets or as in my case,
you have captured some network traffic and you save the results, you can open
the pick up with Wireshark and you can just go ahead and try to investigate.
So there is a.
Two ways you can do this analysis,
the first way is to just go through the stream.
Of your Network traffic captured here, and as long as you can suspect that there is
some kind of lost packet going on from a specific
source to IP, you can just go ahead and click, go to Internet protocol version
down here and you can use the identification number.
So we have these X number and a number decimal number.
You can just go ahead and add this as a column in here in the
in the identification column, you can see the numbers and the sequence
of the numbers from the source IP to the destination IP.
You can just go ahead and look for any
inconsistencies like missing numbers in between like it say.
It says here that we have 19, six, seven, nine and then 686 eight 1 283.
And you can just go ahead all the way down and see if there is a
number that was kept that will indicate that you have lost a packet.
You can do this from any source IP in the network traffic that you captured.
So you can see like from.
OK, so so in this sense, it doesn't seem
that we have a lost packet here, so this is the.
Another way to go through each and every
line of the stream of your network traffic capture, and it's also time consuming, but
if you have the time, you can just go through and
its traffic and filter by source IP if you would like, you can filter out each source
IP that exists in this network, capture viewers.
Another way is that you can utilize
some specific filters in order to make your life easier.
One of these filters is TCP
dot analysis dot lost underscore.
Segment, so you can just go ahead and apply this filter.
And you will see that from this source IP
to this destination, IP, there was a lot of packets, as you can see
in the and the previous segment was not captured.
So you found a gap right there in the sequence.
So that indicates that we have seen a gap in the sequence number, so packet losses
can lead to duplicate acts, which leads to the transmission.
And that leads us to the second filter you
can apply, which you can see all the transmissions in the capture.
So you can go ahead and type TCP analysis, dot return mission.
You can hit enter and you can see the
retransmissions in this network traffic capture if your retransmissions are OK.
But if you have like excessive retransmissions
like more than necessary, I would say, then you should be alarmed.
This usually shows up
as a slow application performance and or like packet loss to the user.
So these were a few ways you can utilize
in order to analyze some network traffic capture analysis that you had.
So that's it for this video.
And you can just go ahead and click on the
next video called Capturing Wireless Traffic on a Selected Network.