How would you identify a TCP retransmission in Wireshark?

• A. Use the display filter tcp.analysis.retransmission; or look for 'Retransmission' in the Info column and the tcp.analysis.retransmission flag.
• B. Look for a packet with 'Out of order' in the Info column.
• C. Search for 'RST' in the Info column.
• D. Retransmissions cannot be detected in Wireshark.

Answer: (A)

Retransmission identification relies on TCP analysis flags that Wireshark assigns to packets. Wireshark marks a segment as a retransmission when it detects that a previously sent sequence number reappears or when an expected ACK is not seen in time, signaling that the sender resent the data. In the capture, these frames typically show the word “Retransmission” in the Info column and carry the tcp.analysis.retransmission flag in the protocol details. Filtering with tcp.analysis.retransmission lets you quickly isolate all such retransmitted segments.

Out-of-order entries indicate packets arriving out of sequence, which is a separate condition and not the same as a retransmission, while a RST indicates a connection reset, not a retransmission. So the display filter approach and the Info column label are the reliable ways to spot TCP retransmissions.