Shark SE400 User's Guide download pdf (Page 146)

Advanced Topics

137

Packet # Severity Group Protocol Summary

2 Chat Sequence TCP Connection reset

(RST)

8 Note Sequence TCP Keep-Alive

9 Warn Sequence TCP Fast

retransmission

(suspected)

7.3.1.1. Severity

Every expert info has a specific severity level. The following severity levels are used, in parentheses

are the colors in which the items will be marked in the GUI:

• Chat (grey): information about usual workflow, e.g. a TCP packet with the SYN flag set

• Note (cyan): notable things, e.g. an application returned an “usual” error code like HTTP 404

• Warn (yellow): warning, e.g. application returned an “unusual” error code like a connection problem

• Error (red): serious problem, e.g. [Malformed Packet]

7.3.1.2. Group

There are some common groups of expert infos. The following are currently implemented:

• Checksum: a checksum was invalid

• Sequence: protocol sequence suspicious, e.g. sequence wasn’t continuous or a retransmission was

detected or …

• Response Code: problem with application response code, e.g. HTTP 404 page not found

• Request Code: an application request (e.g. File Handle == x), usually Chat level

• Undecoded: dissector incomplete or data can’t be decoded for other reasons

• Reassemble: problems while reassembling, e.g. not all fragments were available or an exception

happened while reassembling

• Protocol: violation of protocol specs (e.g. invalid field values or illegal lengths), dissection of this

packet is probably continued

• Malformed: malformed packet or dissector has a bug, dissection of this packet aborted

• Debug: debugging (should not occur in release versions)

It’s possible that more groups will be added in the future.

7.3.1.3. Protocol

The protocol in which the expert info was caused.

7.3.1.4. Summary

Each expert info will also have a short additional text with some further explanation.

1 2 ... 141 142 143 144 145 146 147 148 149 150 151 ... 227 228

No comments

Shark SE400 User's Guide Page 146