Displays in milliseconds the average delay for all packets in the conversation. Because all conversations are separated by application (port or bit match), this gives an indication of the overall application response time for the pair. Further graphical analysis of where in the time scale of the conversation the delays were can be seen by right clicking on the pair and selecting "Time Interval Analysis".
Graph bars dictate the state of the conversation delay by color:
Red indicates a critical event has occurred.
Yellow indicates a marginal event has occurred.
Green indicates that the conversation's communication is within acceptable event parameters.
The color's event trigger point is defined for each application in the Expert Thresholds setup.
A marginal (yellow) or critical (red) event indicates that the ongoing response time for a connection is taking longer than the allocated amount of time set in the Expert Thresholds critical or marginal section of "Slow Response/Slow Connection" for any session level protocol or application. If the session level event is identified as critical, the application level response time analysis will begin and may then be listed in the "Other" column.
The response time for an ongoing connection is graded differently than the initial connection between systems. The event is displayed when the percentage of slow response packets (by application and address pair) is above the critical value set in the Expert Thresholds.
Possible reasons for the event:
High network load.
The system that is being communicated to is too busy, or overloaded.
The connection is being made over an overloaded line (i.e. the router is slow to forward packets).