Warning events and what we can understand from them
As described earlier, warnings events indicate a problem in the application or in communications. In this recipe, we will describe the main events in this category.
Getting ready
Start a capture, or open an existing file and start the expert system.
How to do it...
- From the
Analyzemenu, openExpert Information.
- Warning events will be presented second from the top. If there are no error events, then warnings will be first. You can see an example in the next screenshot (file
CAP_07_04):
You will see several event categories here:
- Reassembly problems, mostly unassembled packets. Usually indicate a Wireshark dissector problem.
- TCP window problems, mostly zero window and window full. Usually indicate slow end devices (servers, PCs, and so on).
- Connection reset, not necessarily a problem. The TCP reset mechanism is further explained in Chapter 11, Transport Layer Protocol Analysis.
- Previous segment not captured, previous segment loss, and out of order...
