Why am I missing packets?
Assuming your Observer has the network visibility it needs— and packets are not being dropped due to hardware or driver issues—there are a few reasons Observer may not “see” packets that you, yourself, were expecting to see. Fortunately, this problem can typically be fixed by changing a simple setting in Observer, which is outlined in this section.
By default, Observer’s packet capture tool is configured to see (i.e. follow) only newly opened TCP connections. A newly opened TCP connection is any connection established after Expert Analysis was started. To change this behavior, complete the following steps:
1. On the Home tab, in the Capture group, click Configuration > Packet Capture.
2. Click the Decode button. The Decode and Analysis tool opens.
3. Click Settings. The Expert Global Settings window appears.
4. Ensure the TCP/IP tab is selected.
 
Figure 18: Expert Global Settings window - TCP/IP tab
 
5. Clear the “Follow only newly opened TCP connections” check box; this changes Observer’s default behavior. A newly opened TCP connection is any connection established after Expert Analysis was started. If the conversation started before Expert Analysis was started, Observer cannot see it.
6. Click OK to confirm and save your changes. You may need to restart the Observer application for these changes to take effect.
 
This change should allow you to see connections that were established prior to opening the packet capture tool, along with the packets they contain. If you are still not seeing all packets, ensure you have all pre-filters deactivated. See Activating and deactivating filters.