How TCP Works - How to Interpret the Wireshark TCPTrace Graph

In this video we will dig into how to utilize the TCPTrace Graph in Wireshark for troubleshooting slow file transfers. The trace files for the video are available to download below:

Like/Share/Subscribe for more Wireshark content!

== More Training from Chris ==

== Live Wireshark Training ==

== Private Wireshark Training ==

[foodsforgoodhealth]

I have learnt about wireshark and tcp from you more than anyone else...thank you bro

[MedhaviN]

You have no idea how much this helps me in my daily loss.. wish i knew this sooner

[johngiles]

Using the stream graphs is so much easier than just scrolling through the trace. Thanks for this explanation Chris!

[wilfriedngongang]

Awesome... I'm partionated by TCP and your are doing something very great.. thx for the VID..

[alinecab]

This is the first time that I watch Chris, and it was a fantastic video🤩. The way you explain it is so clear and straightforward—amazing👌

[worldofnetworksandmore]

Thank you, great explanation. Wireshark is very complicated. Waiting for more of your videos.

[曾建霖-fh]

Thank you very much. This video really helps me to know how tcp trace works.
It is very clear. Thank you~

[amirahmed]

Great 👍 explanation as always. Thanks you Chris.

[zhaoyan]

Thank you, great video. It explained so much to me.

[ferrarisura]

New to your videos, very impressed detailed explanation.

[jjames]

This is great helpful video. Thanks Chris

[samtang]

Hi Chris. Many thanks for the detailed explanation on this graph which help me understand it alot. I do have a question. I got a trace where the data points is actually way above the receive window and not within it. This customer of mine is also having slow throughput. Is also a case of not enough receive window buffer?

[meirzilkha]

Wow this is amazing. Thank you so much!

[sabitkondakc]

Awesome contents, I've a question if you don't mind; QUIC runs on UDP so that it's not possible to analyze it as a graph. Is there a way to graph QUIC packets in WireShark?

[jeanm]

I'm relatively new to tcp analysis and I have a strange example where the window size green graph seems totally uncorrelated to the other bytes in flight (blue) / acknowledge (brown) graphs which is unlike in your example. Also in the trace I have the bytes in flight are always displayed along the brown graph. What is the explanation to what I'm seeing?

[rafaelbianco]

Hey Chris! That was very interesting and insightfull. Is there a set of books and/or courses you recommend for people wanting to further their knowledge on the wireshark/packet analysis game? I dream of a day that I'm like the Yoda of packet captures and I can see issues like Neo on the Matrix! Thanks for sharing!

[zulfiiia]

Thank you for the video! I just started to learn wireshark and needed some good and free resources with some .pcap files to practice. Thank you really much!
one question which I did non find on google. How to change the color of selected packet to something like yours green? in coloring rules I found only filters, but I don't want filters, just selected packet.

[peaky_rida]

Hey Chris...dumb question but how do you enlarge the receivers window?

[optimusprime]

can u explain what happens and the process goes on if i increase the stream here or what is stream no and how it works here
?

[nandhakumarnnk]

How the calculated window size will be same from frame 3788 to 3799??? I am confused in that part