[Bro] TCP segment retransmission v.s. segment out-of-order

Vern Paxson vern at icir.org
Wed Nov 10 19:36:15 PST 2010

> Take a look at tcptrace, http://www.tcptrace.org,  it reliable detects retransmits.

As was mentioned earlier in this thread, it treats any packet with a
sequence number below a hole as reordering.  That's incorrect if packets
can be lost upstream from the monitoring point.


More information about the Bro mailing list