This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm looking to filter data by how long the TCP handshake took.

By this, I mean the time between the first SYN and the last ACK (after the FIN-ACK).

Is this something I can do in wireshark, or something I'm going to have to sort through by hand?

asked 02 Apr '14, 09:21

TrolliOlli's gravatar image

TrolliOlli
1111
accept rate: 0%


The connections overview will show this (to some extend).

Statistics -> Conversations -> TCP [tab]

Then sort the conversations for the column 'duration'.

Hint: This will also show not yet 'completed' TCP sessions, simply because the capture process was ended while the connections were still active!

Regards
Kurt

permanent link

answered 02 Apr '14, 12:36

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×75
×41
×12

question asked: 02 Apr '14, 09:21

question was seen: 3,752 times

last updated: 02 Apr '14, 12:36

p​o​w​e​r​e​d by O​S​Q​A