What happens when you are capturing closer to the client, and the server does not respond? There are many reasons this could happen: I’ll listen for your response on port 42,678.” Step two: the server responds, “Hey client, do you have port 42,678 open (SYN)? I have port 80 open, come on in (ACK).' Finally in step three, the client responds, “Port 42,678 is ready, come on in (ACK).' There are additional items negotiated during the handshake, but I am focusing on just the SYN+SYN/ACK packets for this discussion.

Step one: the client asks, “Hey server, do you have port 80 open? I want to synchronize (SYN). Transmission Control Protocol (TCP) is the most pervasive protocol on the Internet, and it starts with a three-way handshake. Now I can just go to Analyze | Expert Info | Notes, and they will be listed for me. This is something I used to have to hunt for with filters. I am one of those people who actually reads the release notes, so I was very excited to see that Wireshark 1.10.1 now flags a retransmitted TCP synchronize (SYN) packet with an Expert Info Message. Also, new features sometimes slip into a “dot” revision. A major release goes out at least twice annually, with multiple “dot” releases, a.k.a. One thing that makes Wireshark the world’s most popular protocol analyzer is how often the open-source tool is updated. Answer? When it is flagged as a retransmission in Wireshark!

Wireshark retransmission