How to find the packet loss in Wireshark?

Question

I need to test packet loss for an FTP application. I used the Wireshark packet sniffer, and I got TCP Stream.

How do I find the packet loss using Wireshark?

Solution

Packet loss and other related metrics like bit error rate (BER) can be hard or impossible to empirically see by looking at dumps in Wireshark, depending on what layer you're wanting to look at. And a lot of it is highly dependent on what protocols you're using and what software/firmware is implementing it.

I had this exact experience with Wi-Fi routers, for example. I needed to empirically test the BER of a given Wi-Fi link. But it turns out that 802.11 has a TCP-like CRC based retransmit system that all occurs at the link layer.

So, for example, you may send a UDP packet from Wi-Fi device A to Wi-Fi device B. In transit, a couple of bits get flipped, device B sees that the CRC is wrong and sends a request for retransmit. The packet gets sent again, and again gets corrupted. On the third try, though, the packet gets through fine.

From this, you would hope to see some kind of packet loss metric right? Well, unfortunately no. This whole interchange happens below Wireshark. All it sees is a UDP packet get sent successfully, but take three times as long as normal to get there. (I wound up having to make kernel modifications to send out a notice when link layer CRC errors occurred. It was a mess!)

Comments

[Zr40]

'Dropped' in that context means that Wireshark couldn't capture packets fast enough so some were ignored.