zero window trigger

[fmarino]

Does anyone know how to set up a trigger on zero window?
thanks very much.

 

[mbilgrav]

why you wanna do that ?
Every normal ending of a TCP session will produce a zero-window ...

 

[fmarino]

The server is Queuing and data cannot be sent to this device. I wanted set up a sniffer to trigger on "zero window" so I can see what the server is doing when the window size equals zero.

 

[Helmuth2]

Here is how you could do it -
create a pattern match filter.
On a normal IP packet Window Size is at offset 30 length 2 bytes 'anded' with with the IP adress of your server as source address. use this filter then as the event filter on your trigger.

Hint: When you create your filter, you can test it, if you have a trace with this sitiuation just use this filter as a display filter and you will see if it works.

But i agree with mbilgrav that you will have zero windows not only on your error situation.

hope this helps
regards Helmuth

 

[Helmuth2]

there is one more 'and' condition for the filter

at offset 17 Equals 06 (TCP) Protocol - otherwhise you get wrong triggers from ICMP Messages.

regards Helmuth