Retransmissions
Segments went unacknowledged and were sent again. A few are normal. A pattern is a path problem, and the pattern is what matters.
What it looks like
The same sequence number sent twice or more. The report counts them per conversation and grades anything above a couple as Degraded.
Reading the pattern
- Under 1% and scattered: normal. The internet loses packets and TCP recovers; that is the design working.
- Concentrated in bursts: a link filling up. Loss at the moment of congestion, then recovery.
- Steady on one path only: a device on that path — a saturated link, a duplex mismatch, or hardware beginning to fail.
- Steady across every conversation: something they share. The uplink, the switch, or the capture host's own interface dropping frames.
- Only in one direction: often the more useful clue. Loss is rarely symmetric, and the direction points at the leg.
What to do
First decide whether it is this conversation or all of them — the report's conversation list answers that at a glance. Then check interface counters at each hop for errors and discards; duplex mismatches and failing optics both show up there and nowhere else. And check the capture host itself: a machine that cannot keep up with its own capture reports loss that never happened on the wire.