Warning events and understanding them
As described earlier, warning events indicate problems in the application or in communication. In this recipe, we will describe the main events in this category.
Getting ready
Start capturing or open an existing file, and start the Expert Infos window.
How to do it...
From the Analyze menu, open Expert Infos by clicking on Expert Info.
Click on the Warnings: bar. You will get the following window (all events are examples):
You will see here several event categories:
Reassembly problems: These are mostly un-reassembled packets. These are usually indicated as Wireshark dissector problems.
TCP window problems: These are mostly zero window and window full problems. These usually indicate slow-end devices (servers, PCs, and so on).
Segment loss, segments not in order: These indicate previous segment losses and the ACKed segment that wasn't captured. These are usually TCP problems that are caused by network problems.
How it works...
Wireshark watches the parameters...
