There is a handy new feature in Wireshark that just made looking at one of my favorite trace files a little more interesting.
The tcptrace graph has been used by analysts for years to graph the efficiency of data transfers over TCP. It helps us to see sequence number increase over time, the receive TCP window, bytes in flight, retransmissions and acknowledged data. That way if there is a hitch in a download or large transfer, you can quickly spot if the issue and get to digging for root cause.
In the screenshot below we see a tcptrace graph with all the pertinent info.
This graph is great. It has been a huge help for years. As you can see above, there is a long pause in the data transfer, and with a few clicks we can start to deep dive.
But until recently, there was one thing missing that is very important to know when analyzing data transfers – zero windows.