Spotting Packet Loss in Wireshark

This video will show you how to detect packet loss between a client and a server using Wireshark. We'll cover how to spot packet loss visually but also how to quantify how many packets are lost.
Resources:

[@usakott]

Great video, thank you! Was looking for the next one for troubleshooting steps, hope its coming soon

[@smityment674]

Good video. It is very useful to understand how to check the packet loss. good work keep it up !!!! 👏👏👏🙏

[@mtnsolutions]

don't know if it's sad or just telling that I learn more watching your videos that I did while preparing for CCNA and even well into the CCNP

[@plaintextpackets]

That's more a comment on how bad Cisco certs and training have become lol, but thank you!

[@mtnsolutions]

@@plaintextpackets I definitely felt as though the test was pretty gatekeepery. And I walked out with cert in hand wondering why they didn't teach us anything about voip.

[@plaintextpackets]

@mtnsolutions that’s exactly it. It’s just obscurely difficult to make it hard but doesn’t really help you understand network better

[@grabasandwich]

I've been a cable guy for almost 20 years, and wish every customer had something running in their home to monitor their connection and keep detailed logs for guys like me to find a smoking 🔫 when I go to a trouble call for slow or intermittent internet. There are so many variables that even with all the tools the ISP gives us (actual tools and internal diagnostic sites) it's usually difficult to be sure the problem is fixed. Repeat truck rolls negatively affect our metrics, so anything to reduce those is a win for us AND the customer.

[@plaintextpackets]

I totally get it. I’ve worked as a network analyst for a small company with a bunch of branch sites and had the same challenge. Now I work at the enterprise level but it’s the same problem just at a bigger scale.

[@stevek6396]

Another awesome video. Thank you !!

[@plaintextpackets]

Glad you enjoyed it!

[@kevinmelton3771]

Thank you for the very informative video. I have used the technique you have discribed to analyze some packet captures i took using Cisco EPC. I have an extensive amount of packet loss from a client workstation to a server across an MPLS network. the packet loss is usually between 1.7 and 3.4%. We have compaints from our users connecting to that server that they drop their connection several times a day, which is why i started capturing the data. The main issue i am having is only seeing traffic in a unidirectional fashion. I always see the client workstation on the left and the server host on the right. i have manipulated the words on the EPC filter on the cisco switch from in , out, and both.. but it does not change anyting. Would you be able to comment 0n why i only see 1 way traffic in the trace file? Thank you!

[@plaintextpackets]

If you can join the discord we can start a tread and share notes, would be happy to help

[@marlyin666]

thank you

[@lookwht5760]

That's helpful, thanks a lot!

[@simaobonvalot9141]

Hi, thanks for the video. What if I want to know my packet loss for UDP protocol ? Is it possible to know many were lost/dropped during the transmission ?

[@plaintextpackets]

It depends on the UDP protocol. Some protocols like RTP have sequence numbers shown in plaintext. So even though there aren’t retransmissions of packets you can find gaps in the numbers. Another method is for UDP streams that should have a constant bitrate (like a webcam stream). You can graph the I/o rate in wireshark to look for dips in the bitrate

[@daddyegaming]

Hello, if this was a SIP call, what layer should I be looking? TCP or UDP? Thank you!

[@plaintextpackets]

SIP itself could be TCP or UDP, but then the audio stream will use a UDP protocol like RTP. This video focuses on TCP but there are other methods for spotting packet loss in UDP streams

[@plaintextpackets]

Just posted a video on this!

[@daddyegaming]

Thank you! Checking now @@plaintextpackets

[@LokiEML]

So i have an packet loss in a game called valorant up to 45% looking at it with the game stats its mostly incoming up to 95% and outgoing up to 5% my internet company and the val support cant find what causing this

[@plaintextpackets]

Are you on wifi or connected to your router via ethernet cable? If on wifi I would first test with an ethernet cable and see if it gets better (home wifi is notoriously bad). If it's still bad I would take a wide-open capture (kzbin.info/www/bejne/rXqVopmFa5acfNk) and then look for packet loss. Feel free to join the discord to continue troubleshooting: discord.gg/4XE5jSGb

[@samitpiku]

why divide the drop packets with 1400 ? is it the maximum segment size ?

[@plaintextpackets]

What timestamp are you seeing 1400?

[@samitpiku]

@@plaintextpackets ok got it.

[@decipleofWu]

12:01 1418 is the total packets sent between the client and server. The 1400 was just that number rounded down so it would be easier to get a rough estimate of the % packet loss. 113/1418 would still give about 8% (0.079)

[@Foxtrot1967]

HI, Can I hire you to take a look at my capture to troubleshoot LAN issues?

[@plaintextpackets]

I wouldn’t mind looking at it pro bono, is it posted somewhere?

[@Foxtrot1967]

@@plaintextpackets Hello! That would be fantastic. Basically, I'm curious if there are rouge DHCP servers or LAN issues that can be fixed to provide better overall network performace and reliabilty. How long of a capture would you like? 1 min, 5 mins, ? I can upload the file to Google Drive.

[@plaintextpackets]

5 mins would be good to start, you can email the link to [e-mail]

[@plaintextpackets]

@foxtrot1967 I just setup Dropbox as well if you'd like to submit that way

[@train4905]

Exellent😊

[@tahersadeghi6773]

At times, some of your conversation fades away. Some words sound like a murmur.

[@usakott]

Lol, where? He's very clear IMO

[@plaintextpackets]

Sorry you had that experience! I’ve only had time to record videos in batches using my work headset! Maybe someday I’ll invest in a better mic :-)