need to apply filter is to identify any tcp connection timeout
asked 07 Oct '13, 13:34
It depends on the kind of timeout you talk about. If you mean an application timeout where it shuts down the socket you'll see a reset packet. You can filter for that by using "tcp.flags.reset==1".
But if you're talking about "Keep Alives", you could filter for "tcp.analysis.keep_alive".
answered 07 Oct '13, 13:47
If you are looking for connections with only SYN frames (no SYN-ACK), aka 'timed out connection attempts', please see my answer in the following question, especially the third answer (MATE):
tshark is another option:
answered 07 Oct '13, 14:10
Kurt Knochner ♦