This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Finding the sequence of closing TCP connection

0

how to identify the sequence of closing TCP connection from a saved trace?

asked 02 Jul '13, 10:02

Irock732's gravatar image

Irock732
11224
accept rate: 0%


One Answer:

0

TCP connection will be closed with segments with either FIN flag set or RST Flag set.Check out the tcp segments with these Flags set to start with to identify the closing sequence.

answered 02 Jul '13, 10:38

krishnayeddula's gravatar image

krishnayeddula
629354148
accept rate: 6%

edited 02 Jul '13, 10:51

you can use the following display filter:

tcp.flags.fin eq 1 or tcp.flags.reset eq 1

Regards
Kurt

(02 Jul '13, 14:06) Kurt Knochner ♦