how to calculate packet loss from a binary TCPDUMP file
Solution 1:
You can measure packet retransmits from the client to the server by counting the number of duplicate sequence numbers.
Packet retransmits from the server to the client can be measured by counting duplicate Ack numbers.
Note that a retransmit is triggered by more than just total loss (= timeout); if the remote machine rejects the packet, or the packet is corrupted, the local machine must also retransmit.
Solution 2:
tshark can filter retransmission, duplicate ACK, lost segment, ...
$ tshark -r file.pcap -q -z io,stat,1,\
"COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission",\
"COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack",\
"COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment",\
"COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission"
Here's a sample result:
IO Statistics
Interval: 1.000 secs
Column #0: COUNT(tcp.analysis.retransmission) tcp.analysis.retransmission
Column #1: COUNT(tcp.analysis.duplicate_ack)tcp.analysis.duplicate_ack
Column #2: COUNT(tcp.analysis.lost_segment) tcp.analysis.lost_segment
Column #3: COUNT(tcp.analysis.fast_retransmission) tcp.analysis.fast_retransmission
| Column #0 | Column #1 | Column #2 | Column #3
Time | COUNT | COUNT | COUNT | COUNT
000.000-001.000 0 0 0 0
001.000-002.000 0 0 0 0
002.000-003.000 0 0 0 0
003.000-004.000 0 0 0 0
004.000-005.000 0 0 0 0
005.000-006.000 0 0 0 0
006.000-007.000 1 2 1 0
007.000-008.000 3 1 0 0
008.000-009.000 0 0 0 0
009.000-010.000 1 0 1 0
010.000-011.000 0 0 0 0
011.000-012.000 0 0 0 0
012.000-013.000 0 0 0 0
013.000-014.000 1 0 0 0
====================================================================================