Here, our next module will be on Expert advanced features.
So interestingly, in one of the things that we will cover
in this module is yes the Expert as we already discussed
is a tool to give you a clue to guide you.
But it is not in any way going to say
this is specifically your problem based on
what you think may be the problem.
There's a lot of consideration that needs to be taken
when you look at the Expert. For example,
some of the, some of the examples that we gave,
was that if there was a slow performing website or
or network, or something of that nature,
there may be something going on
that the Expert doesn't tell you about.
It may not say that the router is choked up
or the website is freezing.
It will tell you a different way by saying,
you know, when you were trying to go to the website
you got all these re-transmissions.
So just be aware that it is not exactly a tool
to tell you what the problem is. It is a guide.
So what else can you do with the Expert?
There's further customization that you can do.
You can change the Packets List pane to show severity.
That just came up in our Q&A. We'll go into that a little bit deeper.
You can color-code icons in the Expert window to make it more visible.
And you can create preferences and profile settings adjustments to make it more,
to adjust it more so that you could see some specific things.
So one of the things that we were looking at before
was the actual Wireshark tool where we applied a filter to find severity.
We did expert.severity, the whole equals to and offset code
which basically provided us with a high level warning.
I'm sorry, an error, which was the most severe error in this capture.
So, it completely wiped away all of the data from view,
and allowed us to immediately see this packet.
And be able to drill into it deeper to see what the problem may be.
Other things we were able to do which we will explain very briefly
was we were able to go into the preferences and make adjustments
and add a column for the Expert.
And the reason why we wanted to do that is because as we're capturing packets,
I can quickly sort and see very quickly
what packets are flagged from the Expert.
So this is already applied in the capture.
So we can see that right here.
Right here, I have my Expert column that I added.
And it's telling specifically, what the Expert found.
So here's the chat, and this would be found directly in your Expert as a chat.
And we can drill into the packet this way.
or we can find them this way and sort on them.
So you can invoke the Expert from the analyze menu within the capture window.
Once you do invoke the Expert, you can find the information that you need
such as this chat information
that we see in the capture, here, under the Expert column.
Or a possible warnings. But regardless of how we search and sort for it,
it's this further customization that I wanted to point out.
As we mentioned earlier, there is a way to find Expert information.
You can either just search for the Expert and filtering for it or
you can set up an expression as we mentioned earlier to look for Expert info.
And you have multiple things that you can search for -
the Wireshark Expert group, the actual message or the severity level.
These are the 3 refinements that you can make.
So again, when we want to change the look and feel of the Expert,
we can add the color icon. So you can set this up as well in preferences.
You can set up red, yellow, cyan, light blue, blue
and set up other icons on your Expert so that you can more quickly and easily
see what that problem is. Obviously, red - big problem.
So that's just the new customization for the Expert
with the newer releases of Wireshark.
And again, the packet comments are extremely important
as we will learn in the annotation module.
You can quickly annotate your captured data.
And as you find things, make notes in them.
For example, what it is that you think may happen there.
So as you drill into the data, you may say,
'problem with Gateway as I was testing with ping.'
might be relevant to that particular packet.
And then when you open up the Expert, you can go directly to the comments,
and see specific comments in order that were made that may also tell a story.
And here is specifically the chats where it tells us a story
as we have mentioned before where the story may be
we're accessing a website inorder, this is what's going on, the sequence of events.
And it can tell me more specifically what is going on.
The sequence of packets and then I can go over to the details
and it will tell me the entire sequence through the packet capture
flagging the errors, the warnings, and the notes, and the chats.
So I wanted to do for you quickly before we end this module
is I wanted to open up a busier capture.
As you will see this will take quite a while to load and
here we see some bad checksums, which is not always a problem.
Just the way that the data is read. It's not necessarily an error.
Again, a false positive.
But here, we see some issues directly related to window full and zero window.
When we trouble, when we were troubleshooting this problem,
we found that the destination machine did not have enough resources
and it was causing quite a problem with a web based application.
Obviously, we see a tremendous amount of duplicate acknowledgments.
It just continued to resend the data because it could not handle it.
And we were able to trace this through the entire conversation dealing the details.
So again, the Expert is extremely helpful but
you have to really look at the data for what it is
and make sure that you're not assuming anything
and you're really drilling in, drilling down
and really trying to get to the bottom of what the problem could be.