| Event | Description | Severity | Threshold | Possible causes and solutions |
| TCP Reset Connection | An established TCP connection has been reset by one end of the connection, this results in an abnormal termination of the TCP connection. | Information | | A server drops the connection because of improperly configured resources or router problems.A user aborts the Web connection due to slow response from a server.Many older Web browsers use Reset Connection to shut down their HTTP connections; however, newer browsers are better at complying with the TCP disconnection procedures. Due to the fact that many older browsers are still in use, TCP Reset Connection events are very common in many of today's LANs.
|
| TCP Reset Inactive Connection | An established TCP connection has been reset by one end of the connection after the Reset Inactive Connection threshold is reached. | Notice | Reset Inactive Connection - 15 seconds | A TCP Server resets a client connection if the client has been idle for too long.Many older Web browsers use Reset Connection to shut down their HTTP connections; however, newer browsers are better at complying with the TCP disconnection procedures. Due to the fact that many older browsers are still in use, TCP Reset Connection events are very common in many of today's LANs. |
| TCP Repeated Connect Attempt | A client is attempting multiple times to establish a TCP connection. | Warning | |
A firewall may be blocking the SYN packet sent from the client to the server, or ACK packet sent from the server to the client. |
| TCP Connection Refused | A client’s initial TCP connection attempt has been rejected by the target host. | Warning | | A client is requesting a service that the host does not offer.
There are no more available resources on the server to accept new connections.
|
| TCP Retransmission | The sender does not receive an acknowledgment (ACK) from the receiver, and therefore retransmits the packet. | Notice | | The acknowledgment packets are being transmitted via a slower path.The network load is very high.The receiver or router is overloaded.
|
| TCP Too Many Retransmissions | The percentage of retransmissions on a connection is equal to or higher than the Too Many Retransmissions threshold. | Warning | Too Many Retransmissions – 10% | The acknowledgment packets are being transmitted via a slower path.
The network load is very high.
The receiver or router is overloaded.
|
| TCP Fast Retransmission | A TCP sender retransmits a packet before Fast Retransmission threshold is reached. | Warning | Fast Retransmission – 150 milliseconds | The acknowledgment packets are being transmitted via a slower path.
The network load is very high.
The receiver or router is overloaded.
|
| TCP Invalid Checksum | The checksum of a TCP header and/or data is in error. The checksum value is calculated by the sender and written to the packet, and then recalculated from the received packet by the receiver. It indicates an error if the two values are different. | Warning | | There is a faulty device on the network.
If the checksum of all local packets are showed as invalid, it may be the checksum offload feature has been enabled; in this case, the adapter performs the cycle-intensive process of calculating CRC, the Windows TCP/IP stack does not calculate the IP and TCP checksums and leaves them as 0x0000. Colasoft Capsa collects the copy of each outgoing packet before it goes to the adapter. To fix this issue, you need to disable the adapter's Offload Transmit IP Checksum and Offload Transmit TCP Checksum feature in the advanced setting
dialog.
|
| TCP Zero Window Too Long | The window size of one end of a TCP connection being zero is longer than the time specified by the Zero Window Time threshold. | Warning | Zero Window Time – 500 milliseconds | The receiver is very busy.
There are insufficient network buffers in the receiving station.
This is an indirect result of an application program's behavior. For example, the application may be waiting for some other events happening, or the application may not be releasing the frame buffer.An application is very slow.
|
| TCP Slow ACK | The time a connection has taken to acknowledge data exceeds the average acknowledgment time of the connection plus the Slow ACK Time threshold. | Warning | Slow ACK Time – 250 milliseconds | The acknowledgment packets are being transmitted via a slower path.
The network load is very high.
The receiver or router is overloaded.
|
| TCP Window Frozen | The TCP window size has been stuck for three or more consecutive packets and has dropped below a percentage of the maximum observed window for this conversation. | Information | Window Frozen – 50% | Check the source station for insufficient network application. |
| TCP Low Window | The TCP window size has dropped below a percentage of the maximum observed window for this conversation. | Information | Low Window – 10% | Check the source station for insufficient network application. |
| TCP Port Scan | A local or remote station is scanning the network for opening TCP ports. | Warning | | Port Scanning is an intrusion indicator. |
| UDP Invalid Checksum | The checksum of a UDP header and/or data is in error. The checksum value is calculated by the sender and written to the packet, and then recalculated from the received packet by the receiver. It indicates an error if the two values are different. | Warning | | There is a faulty device on the network. |
