Too many TCP retransmission packets seen on Wireshark when PCAP is taken on SRX. However, this is not actually duplicate packets.

Too many TCP retransmission packets seen.

When a PCAP is taken on SRX, the same filter is applied on both IN and OUT interfaces.

And also it is captured on both INBOUND and OUTBOUND flow from an interface.

Hence, the same flow is captured twice.

For example, 192.168.1.1 is accessing 192.168.3.1 on TCP port 22.

192.168.1.1 is on interface A and 192.168.3.1 is on interface B.

So the packets captured will be:

--1st packet:

192.468.3.1/2233-->192.168.3.1/22 on interface A.

--2nd packet:

192.468.3.1/2233-->192.168.3.1/22 on interface B. ----> Duplicate

--3rd packet:

192.168.3.1/22-->192.468.3.1/2233 on Interface B

192.168.3.1/22-->192.468.3.1/2233 on Interface A --> Duplicate

Therefore, the duplicate packet will be reported as TCP retransmission on Wireshark as the tool does not have knowledge of the interfaces.