Wireshark 存储给定 TCP 流的序列号。如果新数据包没有提前序列号，则将其标记为重传。

这是实际的Wireshark 代码epan/dissectors/packet-tcp.c（包含在下面）。

请查看tcp_analyze_sequence_number()函数，更具体地说是从第 822 行开始的块。

epan/dissectors/packet-tcp.c（修订版 33861）的第 822 行：

/* RETRANSMISSION/FAST RETRANSMISSION/OUT-OF-ORDER
 * If the segments contains data and if it does not advance
 * sequence number it must be either of these three.
 * Only test for this if we know what the seq number should be
 * (tcpd->fwd->nextseq)
 *
 * Note that a simple KeepAlive is not a retransmission
 */
if( seglen>0
&&  tcpd->fwd->nextseq
&&  (LT_SEQ(seq, tcpd->fwd->nextseq)) ){
    guint64 t;

    if(tcpd->ta && (tcpd->ta->flags&TCP_A_KEEP_ALIVE) ){
        goto finished_checking_retransmission_type;
    }

    /* If there were >=2 duplicate ACKs in the reverse direction
     * (there might be duplicate acks missing from the trace)
     * and if this sequence number matches those ACKs
     * and if the packet occurs within 20ms of the last
     * duplicate ack
     * then this is a fast retransmission
     */
    t=(pinfo->fd->abs_ts.secs-tcpd->rev->lastacktime.secs)*1000000000;
    t=t+(pinfo->fd->abs_ts.nsecs)-tcpd->rev->lastacktime.nsecs;


    if( tcpd->rev->dupacknum>=2
    &&  tcpd->rev->lastack==seq
    &&  t<20000000 ){
        if(!tcpd->ta){
            tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE, tcpd);
        }
        tcpd->ta->flags|=TCP_A_FAST_RETRANSMISSION;
        goto finished_checking_retransmission_type;
    }

    /* If the segment came <3ms since the segment with the highest
     * seen sequence number, then it is an OUT-OF-ORDER segment.
     *   (3ms is an arbitrary number)
     */
    t=(pinfo->fd->abs_ts.secs-tcpd->fwd->nextseqtime.secs)*1000000000;
    t=t+(pinfo->fd->abs_ts.nsecs)-tcpd->fwd->nextseqtime.nsecs;
    if( t<3000000 ){
        if(!tcpd->ta){
            tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE, tcpd);
        }
        tcpd->ta->flags|=TCP_A_OUT_OF_ORDER;
        goto finished_checking_retransmission_type;
    }

    /* Then it has to be a generic retransmission */
    if(!tcpd->ta){
        tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE, tcpd);
    }
    tcpd->ta->flags|=TCP_A_RETRANSMISSION;
    nstime_delta(&tcpd->ta->rto_ts, &pinfo->fd->abs_ts, &tcpd->fwd->nextseqtime);
    tcpd->ta->rto_frame=tcpd->fwd->nextseqframe;
}