Checks the mistakes that cost the most time: capture syntax in the display bar, the "or 443" trap, != on two-ended fields, renamed fields, brackets, quotes and masks. It does not replace Wireshark's own check: if the bar goes red, believe the bar.
| Field | What it means | Example |
|---|
Five habits that make a capture answer the question
One capture shows what was sent. Only the other end shows what arrived. The difference is where the problem is.
Keep the capture filter simple (a host or a port) so you do not filter out the clue. Do the clever part in the display filter afterwards.
Leave it running and keep the last hour: -b filesize:100000 -b files:10. Stop it as soon as the fault happens.
Comparing two captures, or a capture with device logs, only works when everything is on NTP.
Conversations, Expert Information and the IO graph find the problem faster than reading packets. For MTU trouble, the MTU calculator does the arithmetic.