Using Expert Summary
Expert Summary displays all general, non-conversation specific problems that Observer finds when analyzing the packet capture. Over 700 different expert events can appear here, which you can right-click to further interact with. Expert Summary also provides easy access to viewing utilization rates.
The Expert Summary group tab includes three panels:
Summary graph (top)
Network Conditions Summary table (middle)
Expert Analysis panel (bottom)
The Network Conditions Summary table automatically alerts you of many network events, and one is the presence of duplicate IP addresses. Observer does not have an option that shows cloned MAC addresses. However, seeing duplicate IP addresses can help you see cloned MAC addresses, depending on your network environment.
Furthermore, there are three scenarios which can trigger seeing duplicate IP addresses and potentially retransmissions or duplicate packets because of it:
Two MAC addresses (IP address is traveling layer 3)
Two static IP addresses
Cloned MAC addresses
If you see duplicate packets or retransmissions caused by duplicate addresses, clear the option “IP Duplicate Address and Routing Problems” from the Network tab of the Expert Thresholds (OSI Model) window.
Note: Expert Summary panels. The Summary graph shows utilization by percent of bandwidth and packets per second. If an expert threshold has been exceeded, the top line of the graph (labeled with the alarm) will show a red bar; hovering your cursor over the bar will show details of the event. The Network Conditions Summary table shows any expert thresholds exceeded, including the number of occurrences and a description of the event. Right-click any item to view more details. The Expert Analysis display panel offers general instructions on what options are available in the display and may offer a short explanation of the highlighted item.