I haven't gone that deep, but it reinforces my assumption that the NAT device sends the responses from 199.67.137.5 to 192.168.0.200 instead of sending them to the initial speaker. In fact, it is higher if taken as relative and assuming a rollover if taken as absolute, it is lower, so again the 'retransmission' conclusion is correct.Įven the occurrence of RST packet does not change anything about it because even if everything behaves normally, a retransmission may arrive after RST has been seen in the opposite direction, as Wireshark does not take into account at what interface the capture has been taken. The new sequence number is larger than expected In this particular case (tcp analysis), it is your choice whether to treat the seq/ack numbers as relative ones or absolute ones (relative is a default setting because for most cases it is more convenient for reading) even if set to absolute, the result would be the same. Wireshark protocol dissection and analysis are useful tools assisting you but you must not blindly believe them. Don't blame Wireshark here, as it does not have enough information to mimic the behaviour of the particular server (for some servers, the distance in time would be enough to treat it as a new connection, for others it would not).

Tcp retransmission wireshark shoretel