Transport
TCP
• TCP Connection Refused: The host is rejecting a clients initial TCP connection attempt.
• TCP Connection Lost: TCP data is repeatedly being sent with no acknowledgement until the sender gives up and resets the connection.
• TCP Inactive Connection Reset: The sender has set the RST flag in a TCP packet.
• TCP Connection Reset: One end of a TCP connection has set the RST flag in a TCP packet, which sometimes indicates an abrupt disconnect. The normal TCP disconnect is to FIN although some applications will terminate with a reset or a FIN followed by a reset.
• TCP Too Many Retransmissions: The source IP node is sending another TCP packet with a sequence number that matches a previously sent TCP packet to the same destination IP address and TCP port numbers. “Too many” is when the percentage threshold meets or exceeds that of total transmitted (non-ACK) packets.
• TCP Fast Retransmission (by ACK): The source IP node is resending a TCP packet because the receiver has indicated a missing packet with a triple duplicate ACK (four identical ACK packets in a row).
• TCP Fast Retransmission (by time): The source IP node is sending another TCP packet with a sequence number that matches a previously sent TCP packet to the same destination IP address and TCP port numbers. Retransmits are flagged as “fast” if they occur before the TCP Fast Retransmission threshold.
• TCP Slow First Retransmission: The first retransmission is taking longer than the threshold which may indicate slow recovery time and throughput.
• TCP Retransmission: The source IP node is sending another TCP packet with a sequence number that matches a previously sent TCP packet to the same destination IP address and TCP port numbers.
• TCP Idle Too Long: The TCP connection hasn’t been used since the threshold was set.
• TCP Invalid Checksum: The TCP header and/or data is in error. One or more bits has erroneously changed since the TCP segment was transmitted by the source IP host
• TCP Low Starting MSS: The TCP Maximum Segment Size (MSS) is at or below the threshold setting.
• TCP Repeated Connect Attempt: A client is attempting multiple times to establish a TCP connection.
• TCP Slow Acknowledgement: The recipient appears to be slow in acknowledging TCP data segments based on the threshold added to the average ACK time.
• TCP Slow Segment Recovery: A TCP segment is taking longer than the threshold to complete, which may indicate slow recovery time and throughput.
• TCP Triple Duplicate ACK: A receiving TCP node has noticed one or more missing packets and is requesting that the sender retransmit them by sending 4 identical ACK packets.
• TCP Low Window: The application is not keeping up with the incoming TCP segments. The threshold is based on the percentage of the maximum observed window for this conversation.
• TCP Stuck Window: The TCP window size has not changed for three or more consecutive packets and has dropped below a percentage of the maximum window. The application may be one or more packets behind in processing incoming TCP segments.
• TCP Zero Window: The recipients TCP receive buffer is filling up (low window) or full (zero window).
• TCP Segment Out of Sequence: A TCP data packet’s TCP sequence number is less than the previous data packet’s ending TCP sequence number.
• TCP Segment Outside Window: The flagged TCP packet carries data before or after the available TCP window most recently advertised in an acknowledgement packet from the destination.
• TCP Segment Acked but Missing: A TCP ACK packet that acknowledges data has not yet appeared within the capture.
• TCP Keep-Alive: A TCP Keep-Alive packet can be used to verify that the computer at the remote end of the connection is still available. This packet is sent with the sequence number set to one less than the current sequence number for the connection. A host receiving a Keep-Alive packet responds with an ACK for the current sequence number.
• TCP Keep-Alive ACK: A TCP Keep-Alive ACK packet is sent in response to a TCP Keep-Alive packet.
• TCP Header Incomplete: Packet does not contain a full TCP header.
• TCP Duplicate ACK: The source IP node is sending a TCP packet with an acknowledgment number that matches a previously sent TCP packet to the same destination IP address and TCP port number.
• TCP Selective ACK: SACK is the abbreviation for Selective Acknowledgment. The node that sends the SACK tells the receiver that it has not received some data.
• RSVP Error: RSVP error occurred in an RSVP path message or RSVP reservation message.
• UDP Invalid Checksum: The UDP header and/or data is in error. One or more bits has erroneously changed since the UDP datagram was transmitted by the source IP host.
• UDP Length Exceeds Packet Length: The UDP Length field contains a value which exceeds the actual amount of UDP data in the packet.