This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

how to identify the sequence of closing TCP connection from a saved trace?

asked 02 Jul '13, 10:02

Irock732's gravatar image

Irock732
11224
accept rate: 0%


TCP connection will be closed with segments with either FIN flag set or RST Flag set.Check out the tcp segments with these Flags set to start with to identify the closing sequence.

permanent link

answered 02 Jul '13, 10:38

krishnayeddula's gravatar image

krishnayeddula
629354148
accept rate: 6%

edited 02 Jul '13, 10:51

you can use the following display filter:

tcp.flags.fin eq 1 or tcp.flags.reset eq 1

Regards
Kurt

(02 Jul '13, 14:06) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×752
×146
×36
×27

question asked: 02 Jul '13, 10:02

question was seen: 22,143 times

last updated: 02 Jul '13, 14:06

p​o​w​e​r​e​d by O​S​Q​A