Wireshark-dev: Re: [Wireshark-dev] Expert item for TCP RST flag
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Joerg Mayer <jmayer@xxxxxxxxx>
Date: Thu, 9 Jan 2014 13:29:07 +0100
On Tue, Jan 07, 2014 at 05:09:11PM -0800, Gerald Combs wrote:
> On 1/7/14 4:19 PM, Joerg Mayer wrote:
> > Right now TCP packets with RST are marked as severity chat. Is there a reason
> > why this isn't warn?
> 
> Some applications use RSTs as a way to quickly close connections.
> Internet Explorer is probably the most common example.

The reason for my question is that someone had network trouble and looked
at the error/warning items. Had RST been at that level, he would have found
the problem lots of work hours earlier - the RSTs were infdications of a
real problem.

So the question is: Do we allow lazy application writers to "hide" indications
of real problems in the network?

Ciao
 Jörg
-- 
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.