Wireshark-dev: [Wireshark-dev] packet-tcp.c (expert severity level of zero window)
sake@xxxxxxxxxxxxx schrieb:
http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=24797
User: sake
Date: 2008/04/05 08:18 PM
Log:
Raise the expert priority of all "zero window" related events from
note to error, as a window size of 0 indicates serious problems
in the tcp session.
Hi Sake!
I'm sorry, but I must disagree with your point of view here. First of
all, my experience is that putting the severity level too high is just
not a good idea. My idea for the current error level should be used only
for really serious problems like: malformed packets, internal dissector
bugs and alike.
A zero window is a "normal behaviour" of a TCP network, if the receiving
side is slower in processing the incoming data than the sending side is
doing it's job. Wether this indicates a problem in your network or not
depends on what you're doing. In the embedded world where I (was)
work(ing), this is a pretty common behaviour and nothing really special
(the initial window size is already pretty low, often only 1500 bytes or
so, mainly because of limited memory reasons), therefore I've chosen the
note severity for the zero window stuff.
I can understand that this situation differs on the way the network is
used, but error for all that seems to be way too high for me. So what about:
a) use warn for "window is full" and "zero window" messages
b) use note for the zero window probing, as it's actual normal behaviour
trying to recover from the zero window
I've done similiar for the TCP sequence: "previous segment lost" is a
warn, the usual "Duplicate ACK" and "Retransmission" appearing
afterwards to recover from it only uses note. This way you'll usually
see the actual problem cause pretty well and the recovery from the
problem (usually a lot more packets) is with lower severity.
Having less messages at higher severity levels is a lot easier to work
with the expert infos, compared to dumped with all kinds of stuff.
As I wouldn't call myself a real TCP expert, what do others think?
Regards, ULFL
