He said that user 2 was using the site in the morning and let it timeout. I asked the user 1 if user 2 was using CATS in the morning and let it timeout. He said yes and I asked if it failed to login in and I got a yes. I asked user 1 if someone else was there and using the site. While sitting there testing with this user 1 I say those messages go by with. Later that afternoon I was testing and his session continued to work. That way I got a full capture of connect and disconnect. I had him logout because were not going to test till later in the day.

However that morning when I started the initial packet captures I had the user 1 login and try it. How can I look into what is causing the reused ports? I asked the users how they login and out of the site and they said to me that they usually login and let the session time out. I see the 'TCP Port numbers reused' at every failure.

All routes and traffic are working as expected.

The browser says 'Can't reach this page'. In the afternoon the same connection is trying to be made I see in Wireshark and the client fails to get logged into the site. I however have another IP 192.168.1.30 that worked in the AM of said day. An example is shown below where the 'R' Flag is set on the currently selected Deauthentication frame.I see packets coming from an IP lets just say 192.168.1.47 that authenticate to a webserver with no problem. If you have a frame selected you can tell if it is being re-transmitted by checking the flags exposed in the first IEEE 802.11 decode field below the 802.11 Radio Information - this is displayed in the Packet Details view within Wireshark. Using this filter as a display filter of a 802.11 frame capture will show only frames that have the Retry bit set in the Frame Control Field in the MAC header. It's really easy to visualise this.įirst off - the filter for WLAN Retries is: I really like to understand the detected retransmitted frames vs the total number of frames captured. My favourite way to use it is with the I/O Graph. My favourite Wireshark filter of all time is the WLAN Retry filter. Especially useful when doing 802.11 protocol analysis where the incoming frames can quickly accumulate to many thousands in a very short timeframe. Wireshark filters help drill down to useful information among what can feel like a massive, overwhelming stream.

Wireshark retransmission filter