Note events and what we can understand from them
As described earlier, when Wireshark indicates an event that may cause a problem but is still inside the normal behavior of the protocol, it will be under the note category. TCP retransmission, for example, will be displayed under the notes bar, because even though it is a critical problem that slows down the network, it is still under the normal behavior of TCP.
Getting ready
Start a capture, or open an existing file and start the expert system.
How to do it...
- From the
Analyzemenu, openExpert Information. - The notes events are presented third from the top on the
Expert Informationwindow:
You will see here several event categories:
- Retransmissions, duplicate ACKs, fast retransmissions usually indicate slow network, packet loss, or very slow end devices or applications
- Keep-alive indicates TCP or application problems
- Time to live and routing events, in most cases, indicate routing problems
Note
Additional events will be discussed in the relevant TCP...
