Wireshark 101: TCP Retransmissions and Duplicates; HakTip 133 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this hack tip is brought to you by the
all-new G flex 2 from LG life's good
welcome to AK tip the show where we
break down concepts tools and techniques
for hackers gurus and IT ninjas I'm
Shannon Morse and today we are checking
out Wireshark and dealing with TCP
retransmissions in duplicates often
times you'll find yourself beeps faced
with a really really slow Network you
may have trouble connecting to a site or
a site takes way too long to load when a
network is running slow the
communication has something called high
latency if the connection is really fast
it's considered low latency now whenever
there is high latency and packet loss it
happens because of a router under a
heavy load or a service outage etc TCP
detects these things and then it's
breeze sends the packets which is when
you would see a TCP retransmission TCP
will judge the need for retransmission
based on the RTO or the retransmission
timeout if the packet never receives a
acknowledgment or an ACK in the time
frame set it is retransmitted the time
between the two packets is called the
round-trip time and every time a
retransmit happens the RTO for that
packet doubles eventually depending on
the sender's computer sendings settings
that it'll just drop resending
altogether now windows defaults to five
attempts and some Linux pcs all the way
up to 15 so let's go ahead and look at
my computer at a little demo now I found
this demo example from a book called
practical packet analysis by Chris
Sanders it's a really really crazy
in-depth look on everything having to do
with Wireshark and a lot of stuff I've
just skipped over so I highly suggest
that you check that book out it's by no
starch press so I'll put the link in the
show notes for that as well now if we
look at the very top at this very very
first packet it looks completely fine
but it never receives any kind of
acknowledgment afterwards it just
receives all these weird TCP
retransmission things so we want to find
out why this is happening
it never receives that acknowledgment so
the second one is the first
retransmission that we see the second
packet looks exactly the same except for
the fact that it shows an RTO
time under the expert info now if we
scroll down and we look at the middle
pane now as we open up all these windows
the one you are looking for is under TCP
analysis flags and it's called expert
info if you look down a little bit
farther it tells you what the RTO is and
for this one example it is 0.2 0-6
seconds so that's kind of a long time
and it's all the way down at the bottom
so you'll have to look at a little bit
harder now the RTO time changes for each
packet after this - because they are all
retransmissions so if I look at the next
one down packet number 3 and I scroll
down all the way you'll see that it
increases in time it doubles to 806 or
0.8 oh 6 seconds the next one it shows 2
seconds that's pretty high
4 seconds or 4.4 and then the very last
one is 9 point 2 1 1 seconds
so lots and lots of retransmissions
happening here obviously something wrong
is wrong now moving on to something
called TCP duplicates specifically
duplicate acknowledgments this happens
when the destination receives out of
order packets now all TCP connections
start with an initial sequence number or
an ISSN in each packet after that we'll
go up by the size of its data payload so
if my computer has an is n of say a
thousand and I send a packet with 200
bytes of data then my acknowledgment
should be 1200 because 1,000 plus 200 is
1200 so my next is n should be 1200 and
so on and so forth so it's keep going to
keep on increasing so if my computer
skips a packet and the is n is off the
acknowledgment packet sent back to me
will be a duplicate of the first or the
last correct one so if I have an is n of
a thousand send a packet of 200 the
acknowledgement would be 1200 my new is
n will be 1200 but my computer for some
reason skips a packet and sends a packet
with an is n of 1400 that's too high the
destination says that's not right let's
try that again and it sends me a
duplicate acknowledgement for 1200 again
it's going to keep on doing this up to
three times until I finally send my next
is n is 1200
1,400 in a packet called a fast
retransmission now let's take a look at
an example of this so this would be
under my duplicate acknowledgments so
under here we see a couple of
acknowledgments then we have a duplicate
right here
another acknowledgment a duplicate
another acknowledgment a duplicate so we
have three duplicates right here and
then finally we get a fast transmission
from the source to the destination which
is going to have the actual amount that
is set correctly now if we look under
fast the transmission control protocol
I'll open this a little bit so you can
see it we have our acknowledgement
number right here one we have our next
sequence number is 13 69 relative
sequence number and then under here
we'll have our expert info again this is
very very important expert information
which is going to be included in these
kind of fast retransmissions
note under here too you'll say severity
level note and this is a suspected fast
retransmission so that's the easiest way
to tell if your you end up having some
kind of skip in your is N and you need
to send another fast retransmission or a
duplicate acknowledgement from the
destination source so let me know what
you think of course this is really
interesting to me I've been geeking out
about Wireshark for a while now but I'm
going to be wrapping up pretty soon some
of you comment below or you can email us
tips at hack 5 org and be sure to check
out our sister show hack 5 for more
great stuff just like this I'll be there
reminding you to trust your titanal list
this hack tip is brought to you by the
all-new G flex 2 from LG life's good