In our next module, we will cover using the Expert.
The Expert is a tool that you can use with Wireshark
that will help you zoom in or give you a clue
as to what may be going on within your capture.
It will provide some intelligence in what it thinks could be happening.
For example, you may have a lot of re-transmissions due to a performance issue.
It will tell you that you have a lot of transmissions,
re-transmissions, suspected re-transmission issue.
It will tell you if you have malformed or corrupted data in its opinion.
However, some of the data is and could be a
false positive and may point you in the wrong direction
if you're not familiar with what it is that you're looking at.
A good example is if, let's say, you're getting a couple of re-transmissions,
and you think that's a problem but it was just a brief issue.
That's how TCP/IP is, or TCP is supposed to operate
and it's not necessarily a problem but it is being flagged in the Expert.
So, the Expert is a guide.
I like to call it a guide because it guides me into helping solve issues.
It doesn't tell me what the problem is.
It helps to point me in the correct direction.
It is helpful for me to baseline activity on my network
or the network that I am troubleshooting.
You should remember there are false positives.
It's possible problems.
It very well may show you that you do have an issue.
But again, you have to have some foundational experience and knowledge
in networking to be able to read what that is and read through it.
And based on what you're troubleshooting, the information could even be limited.
So it may not show you a problem. You may overlook a problem
if you're just looking at the Expert. So remember, it's a guide.
So what can you find? I like to call them clues.
We'll pull up Wireshark now and we'll take a look at the Expert.
And you could find this in the analyze menu under Expert info.
And although I've modified mine a little,
and I will show you how to do that in the next module.
It will show me basically errors. Here I see a malformed TCP packet,
warnings, a few notes based on some duplicate ACK's.
Again, it may not be a problem.
It may just be how the network is operating at that time.
It doesn't necessarily mean that it is the cause of the performance issues.
So remember, it's guiding you.
It's not necessarily telling you what the problem is.
There's, there's no correlation between the fact that
you know that there's a performance issue or that's what you're told.
And you capture some data, open up the Expert and see some information.
It may or may not be correlated so you have to do some investigation.
It will tell you specifically what packets are tied to what information.
So as you see, there's many get requests here.
This isn't primarily a HTTP-based, webserver-based communications.
So I may be able to pull some information from here.
There's further details and interestingly,
which we'll get to in one of the last couple of modules,
is that you can, as you go into your packets,
annotate a packet to say something specific, like you may find a packet that's an anomaly.
And you may want to enter or annotate it and leave a comment.
And you can also see that in the packet comments tab here.
So, there is some information that you can glean from here but remember,
it's not necessarily going to point you to what you think may be the problem.
It's going to give you a clue and will guide you.
Specifically, you will find Expert information in the details pane.
It might, you may have to drill down for it but as you go into
the Expert and you flag a packet, this packet in particular.
Packet 532, if I go into 532.
It will mark the packet up with Expert information.
So that's how I know particularly that I have Expert information
viewable in the actual detail pane.
So I can drill even deeper down into it
to see exactly what that message was.
Ok. So as we mentioned,
the Expert will provide you with some information.
It will not necessarily give you the, the problem.
It may help to solve the problem but
it's generally just a way to take a look at what Wireshark thought
was interesting about the packets and provide them in an area where you can go through it
and try to surmise for yourself through further investigation and analysis
what could be the problem.
Common ones would be, for example,
if you had a windowing issue or buffering, what does that really mean?
It's telling you that there's an issue but that does mean there is
overwhelmed buffers on the client? Or the client has,
doesn't have enough resources to work the data.
Or is it slow through the network and on the destination end is being overwhelmed?
So again, just seeing something may give you a clue but
you're going to have to dig a little bit deeper into it.
So as we were looking at before, there's multiple tabs in Wireshark Expert.
Let me just pull that back up. Here, you will see that you have an errors tab.
And the errors will show you if it may be a major issue such as corrupted data.
This is something that you immediately want to take a look at and flag.
This packet in particularly. Again, this is a small capture.
At the end of the session, I will open up a larger capture.
One full of problems and show you just how busy the Expert can get.
But in particularly here, the errors will show you something of major significance.
Warnings show less serious but more likely to be a potential issue.
It could be something similar to a disconnect.
Notes show less serious warnings.
Application error codes, we saw some get requests.
We might see some page errors on HTTP like
400 or 500 errors or something of that nature. You would see that in your notes.
Your chats will show you conversation traffic such as the TCP handshake.
So as you can see in here,
you have ACK, SYN ACK, reset, connection reset.
So we may want to see, wow, we have quite a few connection resets,
all seemingly to be in a row. So what could be causing the reset?
Is that normal? So it's giving you a clue there.
Details, it will show you details from the other 4 tabs.
So, here in the severity, will show you the tab.
So, here we see one from the chat, so more information.
We see a note. We see, as we drill down, here's an error.
Here's the major one but it's nice 'cause it shows you in packet order.
So what you can do is it'll tell you a story from the start to the finish of the capture,
everything that the Expert caught and it may be able to help you.
For example, here we see an entire HTTP communication.
We see a 304 not modified.
We see an established, connection established request.
So you're actually seeing in sequence which all may lead up to
a problem where as we saw it at the end of the sequence of HTTP,
we saw re-transmission and a possible malformed packet.
And again the packet comments are new with newer versions of Wireshark.
If you saved the capture as a, a PCAPng, you will be able to make and save comments
into the packets and or the entire capture file.
You can also run filters directly from.
So as we mentioned when we were talking about filtering,
you can filter directly from the Expert.
This is extremely helpful because if you're interested in figuring something out,
you may want to drill down into the data and filter it.
Ok, welcome back.
Before we start the next module, we will look at the questions and answers.
In the chat, I saw a really good one. Is it possible to sort types of alerts by severity?
The answer is yes. So in order to do that, you basically come into your,
your Wireshark capture, as you can see on the screen.
And you're going to want to write a filter expression.
So what you can do
in the Wireshark filter expressions is search for Expert,
and once you find Expert, drill down to severity.
Now you can do any type of relation but if you do equal to,
let's see, we'll choose error. Then it will search for specifically that severity.