Expert Information
The expert window collects notes the dissectors already made. Severity is how loud the note is, not how serious the incident is.
A list of notes, grouped
Analyze, then Expert Information, gathers the notes attached to frames: errors, warnings, notes, and chats. Each line is a count and a kind of comment, and opening it filters the list to the frames that earned it. You get a way to jump. You do not get a ranked incident report.
The severities are about the protocol decode. A checksum error is loud. A zero window is a warning. A chat-level remark can be the one that explains your stall. Read the text of the note and the frames under it. Ignore the temptation to sort your whole findings list by the expert severity colors.
Notes you will see in ordinary lab files
TCP notes dominate busy files: retransmissions, duplicate ACKs, previous segment not captured, zero windows, and connection resets. DNS notes call out malformed names and odd reply codes when the dissector is willing to. A “previous segment not captured” pile at the start of a file is the capture opening mid-stream. Confirm that by looking at the timestamps of the first frames before you call it loss.
Apply your display filter first, and check that the expert window is following it. A warning count for the whole morning is a different number from a warning count for tcp.stream 7. Quote the one you meant.
Worked case: the warning that was a mid-stream capture
You open a five-minute lab file and the expert window shows dozens of “previous segment not captured” warnings, all in the first second, all on streams that have no SYN in the file. The capture started while those transfers were already running. The warnings are the dissector noticing a missing past. Later minutes of the same streams show ordinary ACKs and no further gaps.
You write “capture started mid-stream; expert warnings at open are the missing prefix.” A single retransmission cluster at 14:06, on a stream that does have a handshake, stays in the note as a separate event. The window helped you find both. It did not decide which one mattered.
tcp.analysis.lost_segment
The same list from a file
tshark -n -r lab.pcapng -q -z expert prints the expert items for a file you already have. Add a display filter with -Y when you want one host. Paste the relevant lines, not the entire dump, and keep the filter in the note.
If a note surprises you, click the frame and read the field. Expert text is a summary of a field you can name. The field is what you cite.
tshark -n -r lab.pcapng -q -z expert
Diagram
Severity tells you the kind of note, not the impact
- Open
Open Expert Information after the display filter is set to the question.
- Jump
Open one item and read the frames it selected.
tcp.analysis.lost_segment
- Context
A burst at the first second, with no SYN, is a capture that started late.
- Cite
Cite the field and the frames. Leave the color of the warning in the tool.
How loud the note is, and what to do with it
- Error
The dissector is unhappy about the frame itself, often a checksum or a malformed field. Confirm it is not an offload artifact before you quote it.
- Warning
A condition worth seeing: a zero window, a reset, a suspected retransmission. Impact still depends on the stream and the time.
- Note and chat
Quieter remarks, including windows that updated and conversations that opened. They are useful when you are building a timeline.
Check yourself
1. What is Expert Information for?
2. Dozens of “previous segment not captured” notes sit in the first second, on streams with no SYN. What is the likely explanation?
3. How do you print the expert list for a saved file without a new capture?