What does the display filter tcp.analysis.retransmission show?

• A. Packets identified as TCP retransmissions by the analyzer
• B. Packets that are out of order
• C. Packets containing retransmitted payloads only
• D. All TCP packets regardless of retransmission

Answer: (A)

This filter shows the TCP segments that Wireshark’s TCP analyzer has labeled as retransmissions. The analyzer tracks what has been sent and what has been acknowledged, and if a segment isn’t acknowledged in time or a series of duplicate ACKs suggests a missing piece, it marks that segment as a retransmission. The filter selects exactly those packets flagged as retransmissions by the analyzer. It doesn’t focus on out-of-order packets (that uses a different indicator), nor is it limited to only payload data or to all TCP packets—only the retransmitted segments are shown.