Expert Information

Wireshark keeps track of any anomalies and other items of interest it finds in a capture file and shows them in the Expert Information dialog. The goal is to give you a better idea of uncommon or notable network behavior and to let novice and expert users find network problems faster than manually scanning through the packet list.

You can open the expert info dialog by selecting Analyze → Expert Info or by clicking the expert level indicator in the main status bar.

Right-clicking on an item will allow you to apply or prepare a filter based on the item, copy its summary text, and other tasks.

Tips and Tricks

Filter for SYN retransmission

tcp.analysis.retransmission and tcp.flags.syn == 1

References