Wireshark's tcptrace time sequence graph shows a good deal of information, but I cannot find a document that spells out exactly what it all means. It's broadly similar to the original tcptrace except for the colour scheme and a few missing elements:
- Blue I-beams indicate packets sent (cf. white and red arrows in
tcptrace; Wireshark does not show retransmissions differently) - A green line indicating the calculated receive window (cf. a yellow line in
tcptrace) - A brown line indicating the acked sequence number, with little ticks indicating a received ACK that didn't ack anything new (cf. a green line in
tcptrace) - SACKs are shown as red or brown vertical lines (cf. purple lines in
tcptrace) - Special packets (SYNs, FINs etc) are not shown specially.
Here is an example showing all of these features.
However, I cannot see any obvious difference between the red and brown SACKs; it seems that the highest SACK is coloured red and the lower ones are brown, but this doesn't seem to me to be something worth distinguishing with different colours so I think I am missing something. What is the real reason for the two different SACK colours?
