前言

在之前的《虚假的 TCP Spurious Retransmission》文章中曾提到一个错误判断为 TCP Spurious Retransmission，实际为 TCP Out-Of-Order 的案例，本次继续探讨一个虚假的 TCP Spurious Retransmission 案例。

问题背景

TCP Spurious Retransmission ，Wireshark TCP 分析标志位的一种，文档定义如下：

Checks for a retransmission based on analysis data in the reverse direction. Set when all of the following are true:The SYN or FIN flag is set.This is not a keepalive packet.The segment length is greater than zero.Data for this flow has been acknowledged. That is, the last-seen acknowledgment number has been set.The next sequence number is less than or equal to the last-seen acknowledgment number.Supersedes “Fast Retransmission”, “Out-Of-Order”, and “Retransmission”.

简单来说，是在数据包跟踪文件中已经被 ACK 确认过的数据分段，又再一次被重传发送，那么这个重传的数据分段会被标记为 [TCP Spurious Retransmission]。

本案例所说的虚假的 [TCP Spurious Retransmission]，虽然也指的是 Wireshark 判断错误，但真实的问题并不是 Wireshark 所产生。

问题信息

数据包跟踪文件基本信息如下：

λ capinfos "SR 02.pcapng"File name:           SR 02.pcapngFile type:           Wireshark/... - pcapngFile encapsulation:  EthernetFile timestamp precision:  nanoseconds (9)Packet size limit:   file hdr: (not set)Packet size limit:   inferred: 58 bytesNumber of packets:   20File size:           2304 bytesData size:           15 kBCapture duration:    0.135371488 secondsFirst packet time:   2023-05-08 09:30:00.473685315Last packet time:    2023-05-08 09:30:00.609056803Data byte rate:      111 kBpsData bit rate:       892 kbpsAverage packet size: 755.00 bytesAverage packet rate: 147 packets/sSHA256:              a57b14efacc0da4d119336110c39c193fb06d775632033e909cdae5c6c6b26e8SHA1:                50b8444b92baaffcf5c29068717d258a99bc3893Strict time order:   TrueCapture application: Editcap (Wireshark) 4.0.5 (v4.0.5-0-ge556162d8da3)Capture comment:     Sanitized by TraceWrangler v0.6.8 build 949Number of interfaces in file: 1Interface #0 info:                     Encapsulation = Ethernet (1 - ether)                     Capture length = 262144                     Time precision = nanoseconds (9)                     Time ticks per second = 1000000000                     Time resolution = 0x09                     Number of stat entries = 0                     Number of packets = 20

数据包文件通过 NPM 回溯分析下载，并根据 IP 通讯对做过特定过滤，且经过 TraceWrangler 匿名化软件处理。由于是截取数据包原因，所以捕获总时长为 0.135 秒多，数据包数量 20 个，传输速率 892 kbps。

关于 TraceWrangler 匿名化软件简介，可以查看之前的文章《Wireshark 提示和技巧 | 如何匿名化数据包》

专家信息如下，因为数据包特定截取且数量较少，所以仅有虚假重传、重传、ACK确认未捕获的分段等几个常见问题。