Tip of the Month

Network Analysis Tip of the Month – July 2005

Getting the Expert Back on Track

Author – Fred Phillips

Usually the Expert is very good at figuring out which node is the client and which node is the server, but there are some situations when it can become confused, and can lead to messages from the Expert reporting false alarms such as "Slow Server Response Time". This usually occurs when a capture is started when a conversation is already in progress on the wire, and non-standard port numbers are in use.

There is a simple fix for this that can get the Expert back on track:

• From the Expert screen, select the nodes that are being confused and right click on them.
• Choose "Insert into name table" and use the pull down menu to force one node to Workstation and the other to Server.
• Remember, the Expert only recalculates if the buffer is changed, so to force a recalculation: Right click on the conversation, choose "Select Related Packets/By Flow (or conversation). Then choose "Hide Unselected Packets".
• The Expert will now reverse the nodes and all calculations about server response times will be correct.