System information

286 Real-Time Expert
Expert Global Settings – TCP/IP Tab
These items define how IP conversations will be identified.
Compact multiport connections to a single connection for:
• “TCP subprotocols” checkbox—when selected, multi-port conversations (for the
same pair) will be shown as one conversation. In this case, each port-based Expert
event for the conversation pair will be summed and displayed as a total (of all items)
seen on all ports for that conversation.
When not selected, every port will be listed as a separate line and displayed as a
separate conversation item.
• “Show undetermined TCP protocols as one connection” checkbox—when selected,
port-based protocols that are not identified by Observer are collected into one
conversation display line.
• “UDP subprotocols (except DNS)” checkbox—when selected, multi-port
conversations will be shown as one conversation. In this case, each port-based expert
event for the conversation pair will be summed and displayed as a total (of all items)
on all ports for that conversation.
When not selected, every port will be listed as a separate line and displayed as a
separate conversation.
• “Show undetermined UDP protocols as one connection” checkbox—when selected,
port-based protocols that are not identified by Observer will be collected into one
conversation display line.
• “DNS protocol over UDP” checkbox—by default, this box is checked to compact
DNS requests into one conversation. (DNS conversations are treated separately in
Real-Time Expert. The reason for this is that Observer sends many DNS packets in an
attempt to resolve all IP addresses in all list boxes; if DNS was not compacted, there