osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

TCP: Obvious Spurious Retransmissions are not always detected 

In rare circumstances Spurious Retransmissions are not detected
and the SEQ analysis would instead conclude with a Fast Retransmit
or an Out-Of-Order. As Spurious Retransmissions are more certain
than the latter ones, their respective precedences are changed.
The documentation is updated accordingly. Closes #13863.
This commit is contained in:
Eugene Adell 2021-02-27 19:23:42 +01:00 committed by Wireshark GitLab Utility
parent 51cf733fc6
commit 439ecf98b6
2 changed files with 17 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
docbook/wsug_src/WSUG_chapter_advanced.adoc
View File

@ -466,7 +466,7 @@ Set when all of the following are true:
* The current sequence number equals the next expected acknowledgement number.
* We saw the last acknowledgement less than 20ms ago.
Supersedes “Out-Of-Order”, “Spurious Retransmission”, and “Retransmission”.
Supersedes “Out-Of-Order” and “Retransmission”.
// TCP_A_KEEP_ALIVE
[discrete]
@ -507,7 +507,7 @@ Set when all of the following are true:
* The last segment arrived within the Out-Of-Order RTT threshold.
The threshold is either the value shown in the “iRTT” (tcp.analysis.initial_rtt) field under “SEQ/ACK analysis” if it is present, or the default value of 3ms if it is not.
Supersedes “Spurious Retransmission” and “Retransmission”.
Supersedes “Retransmission”.
// TCP_A_REUSED_PORTS
[discrete]
@ -534,7 +534,7 @@ direction. Set when all of the following are true:
* Data for this flow has been acknowledged. That is, the last-seen acknowledgement number has been set.
* The next sequence number is less than or equal to the last-seen acknowledgement number.
Supersedes “Retransmission”.
Supersedes “Fast Retransmission”, “Out-Of-Order”, and “Retransmission”.
// TCP_A_RETRANSMISSION
[discrete]

28
epan/dissectors/packet-tcp.c
View File

@ -2234,6 +2234,20 @@ finished_fwd:
seq_not_advanced = FALSE;
}
/* Check for spurious retransmission. If the current seq + segment length
* is less than or equal to the current lastack, the packet contains
* duplicate data and may be considered spurious.
*/
if ( seglen > 0
&& tcpd->rev->tcp_analyze_seq_info->lastack
&& LE_SEQ(seq + seglen, tcpd->rev->tcp_analyze_seq_info->lastack) ) {
if(!tcpd->ta){
tcp_analyze_get_acked_struct(pinfo->num, seq, ack, TRUE, tcpd);
}
tcpd->ta->flags|=TCP_A_SPURIOUS_RETRANSMISSION;
goto finished_checking_retransmission_type;
}
/* If there were >=2 duplicate ACKs in the reverse direction
* (there might be duplicate acks missing from the trace)
* and if this sequence number matches those ACKs
@ -2276,20 +2290,6 @@ finished_fwd:
goto finished_checking_retransmission_type;
}
/* Check for spurious retransmission. If the current seq + segment length
* is less than or equal to the current lastack, the packet contains
* duplicate data and may be considered spurious.
*/
if ( seglen > 0
&& tcpd->rev->tcp_analyze_seq_info->lastack
&& LE_SEQ(seq + seglen, tcpd->rev->tcp_analyze_seq_info->lastack) ) {
if(!tcpd->ta){
tcp_analyze_get_acked_struct(pinfo->num, seq, ack, TRUE, tcpd);
}
tcpd->ta->flags|=TCP_A_SPURIOUS_RETRANSMISSION;
goto finished_checking_retransmission_type;
}
if (seq_not_advanced) {
/* Then it has to be a generic retransmission */
if(!tcpd->ta) {