Crosses on TCPtrace graph meaning

edit

Looking at the tcp_stream_dialog.cpp source code, the comment on line 288 and following lines of code indicate that they are representative of a TCP zero window condition. You should be able to verify that.

Note that the use of these crosses to depict a TCP zero window condition seems to differ from the tcptrace's use of these "Little crosses", which are described in the Time Sequence Graph section of the tcptrace manual as follows:

Little crosses (x) These are segments sent with zero TCP data payload (the down and up arrows of the segment coincide, giving rise to a cross).