This is our old Q&A Site. Please post any new questions and answers at

how to identify the sequence of closing TCP connection from a saved trace?

asked 02 Jul '13, 10:02

Irock732's gravatar image

accept rate: 0%

TCP connection will be closed with segments with either FIN flag set or RST Flag set.Check out the tcp segments with these Flags set to start with to identify the closing sequence.

permanent link

answered 02 Jul '13, 10:38

krishnayeddula's gravatar image

accept rate: 6%

edited 02 Jul '13, 10:51

you can use the following display filter:

tcp.flags.fin eq 1 or tcp.flags.reset eq 1


(02 Jul '13, 14:06) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 02 Jul '13, 10:02

question was seen: 25,840 times

last updated: 02 Jul '13, 14:06

p​o​w​e​r​e​d by O​S​Q​A