top of page
  • Writer's pictureLaura Chappell

Customize the Wireshark Expert

What is the Expert?

If you use Wireshark for troubleshooting, you MUST open the Expert Information window! Wireshark's Expert interprets the traffic to point out possible problems in the trace file. The Expert Information button is at the bottom left corner of the Wireshark window (the left side of the Status Bar) and is color coded to indicate the highest level of severity seen by the Expert.

Expert button

The Expert Information window can alert you to a number of issues in your communications:

  • Packet loss

  • Receive buffer full

  • Port reuse

  • Out-of-order segments

  • Failed dissectors

The image below shows the Expert Information window for wwb001-movietime.pcapng. The Expert Information window indicates we have some problems with a subdissector for HTTP, a receive buffer issue (Zero Window), connection resets (what?), out-of-orders, packet loss and more.

TCP resets visible in the Expert Information window

WANT TO LEARN MORE? We offer on-demand, online and instructor-led courses on Wireshark and TCP/IP communications! Check out the links under "Training" on the menu for more information and sign up for our biweekly newsletter to know when future blogs, events, or freebies are announced. Every new sign up also gets five free Wireshark labs!

TCP Resets Expert Setting Always Bugged Me

One of the Expert indications that bugs me is the "Connection reset (RST)" item listed as a warning. Why should I be warned that there are TCP resets in the trace file? Those are normal. If there are TCP resets because of a port scanning process, I can detect those through a button or coloring rule.

We can change how the Expert classifies items!

Change the Expert Preference Setting

So let's change the way Wireshark categorizes these TCP resets.

Select Edit | Preferences | Expert. Click the + button to add an entry. Enter tcp.connection.rst in the Field Name column and select Note as the severity. Click OK to save this setting. If you have a trace file loaded when making a change to the Expert preferences, Wireshark automatically rescans the trace file to apply the change.

Adding an Expert preference entry

There is one area of this process that might cause you grief - where do you get those pesky field names? Look inside any packet that is linked in the Expert - the field of interest is above the Severity level entry, as shown below. In the example below, I have selected the [TCP Zero Window segment] line inside the [SEQ/ACK analysis] area of a TCP header. If I wanted to make a change to this Expert preference setting, I would use the field name tcp.analysis.zero_window.

Look above the severity section for Field Names

Wireshark stores changes to the Expert in the expert_severity configuration file within the profile in which you are working. It's a pretty simple file and you can quickly pick up the syntax. You'll see the traditional "DO NOT MODIFY" message, but in truth - you can modify the file, just realize that you need to save it and reload the profile in which it resides.

The expert_severity file

When you reopen the Expert Information window, you should see the result of your changes to the Expert preferences.

The Note section of the Expert

That's much better!

If you want to use the same setting in another profile, you would need to copy the expert_severity file to that profile.

Importing Expert Settings from Other Profiles

This step became much simpler with the recent updates to Wireshark. Did you notice the "Copy from" button at the bottom of in the Expert Preferences window?

Copying Expert settings

That's it! Relatively simple, eh?



2 comentarios

safflow ertimely
safflow ertimely
29 may

The wwb001-movietime.pcapng Expert Information window is seen in the picture below. We have issues with an HTTP subdissector, a receive buffer problem (Zero Window), connection resets (what? ), out-of-orders, packet loss, geometry dash and more, according to the Expert Information window.

Me gusta

Miembro desconocido
04 sept 2021

The Golden Nation Warriors acquired adequately ashamed by means of the Toronto Raptors upon Friday evening, wasting 130-77. Sure, yourself browse that rating effectively. They misplaced by means of 53 information. I'm guessing that they did not do perfectly upon their pregame keys in direction of victory against my preview. Nonetheless enable's plug our noses and obtain out.Brain upThe top secret: Have on't be very low upon electric power and assurance at the time a deflating decline.The final result: Effectively I glimpse fairly terrible for which include this 1. Or maybe Incredibly superior, for the reason that I bet it was an substantial solution.Possibly it was Thursday's decline, probably it was a back again-toward-again upon the street…

Me gusta
bottom of page