Or it could be that there is an error in the TCP receiver. It could be that the machine is running too many processes at that moment, and its processor is maxed. This means that the machine is not able to receive further information at the moment, and the TCP transmission should be halted until it can process the information that is pending in it’s buffer. TCP Zero Window is when the Window size in a machine remains at zero for a specified amount of time. If you want to filter on TCP duplicates use this wireshark filter: These are called fast retransmissions.Ĭonnections with more latency between client and server will typically have more duplicate acknowledgement packets when a segment is lost. In most cases, once the sender receives three duplicate acknowledgments, it will immediately retransmit the missing packet instead of waiting for a timer to expire. They are a common symptom of packet loss.

Typically, duplicate acknowledgements mean that one or more packets has been lost in the stream and the connection is attempting to recover.

Most packet analyzers will indicate a duplicate acknowledgment condition when two ACK packets are detected with the same ACK numbers. If you want to filter on TCP transmissions use this wireshark filter: Above you can see that after more than 1s a frame get’s sent again.

Wireshark tcp retransmission filter