- From the Analyze menu, open Expert Information.
- Warning events will be presented second from the top. If there are no error events, then warnings will be first. You can see an example in the next screenshot (file CAP_07_04):
You will see several event categories here:
-
- Reassembly problems, mostly unassembled packets. Usually indicate a Wireshark dissector problem.
- TCP window problems, mostly zero window and window full. Usually indicate slow end devices (servers, PCs, and so on).
- Connection reset, not necessarily a problem. The TCP reset mechanism is further explained in Chapter 11, Transport Layer Protocol Analysis