This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How can I know the number of open TCP streams in the pcap file?

asked 18 May '11, 04:23

AlexLA's gravatar image

AlexLA
1112
accept rate: 0%

What do you mean by "open"? TCP stream that are still ongoing when the trace ended, or just any connection that had data transfers?

(18 May '11, 05:13) Jasper ♦♦

If you just want to know how many TCP streams are in a pcap file you can use the Conversations Statistics and look at the number given on the TCP tab.

If you then want to find out how many TCP streams are still open at the end of the trace file you need to find out how many of the total TCP streams have terminated within the trace file. Filter for tcp.flags.reset==1 or tcp.flags.fin==1 and open the conversation statistics again, select the "Limit to display filter" option at the bottom and take a look at how many TCP conversations are left. This the number of streams that have been terminated either with a reset packet or a fin packet. Substract that number from your total stream count and you should be done.

permanent link

answered 18 May '11, 09:39

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×12

question asked: 18 May '11, 04:23

question was seen: 22,714 times

last updated: 18 May '11, 09:39

p​o​w​e​r​e​d by O​S​Q​A