As described earlier, when Wireshark indicates that an event may cause a problem but is still inside the normal behavior of the protocol, it will be under the Notes bar. TCP retransmission, for example, will be displayed under the Notes bar because even though it is a critical problem that slows down the network, it is still under the normal behavior of TCP.
You will see here several event categories:
Additional events will be discussed in Chapter 9, UDP/TCP Analysis, Chapter 10, HTTP and DNS, Chapter 11, Analyzing Enterprise Applications', Behavior, and Chapter 12, SIP, Multimedia, and IP Telephony.
Wireshark watches the parameters of the monitored packets. It watches TCP sequences and acknowledges numbers while checking for retransmissions and other sequencing problems. It looks for IP Time To Live (TTL) with value of 1 coming from a remote network, and tells you it is a problem. It looks for keep-alives that may be in a normal condition but can also indicate a problem.
These parameters, along with many others, provide you with a good starting point to look for network performance problems.
Many symptoms that are seen here can be an indication of several types of problems. For example, a packet can be retransmitted because of an error that caused the packet to be lost, because of bad network conditions (low bandwidth or high delay) that caused the packet not to arrive on time, and it can be also because of a nonresponsive server or client. The Expert Info system will give you the symptom. We will learn later in this book how to solve this problem.
18.116.67.177