This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How do I determine a TCP segment’s length

0

How do I determine a TCP segment's length - Header length + No. Bytes in flight?

asked 22 May '11, 20:49

jaden's gravatar image

jaden
1112
accept rate: 0%


3 Answers:

3

The TCP payload size is calculated by taking the "Total Length" from the IP header (ip.len) and then substract the "IP header length" (ip.hdr_len) and the "TCP header length" (tcp.hdr_len).

The "Bytes in Flight" field shows the amount of data that has been sent, but not yet ACKed (seen from the perspective of the point of capture).

answered 23 May '11, 01:02

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

0

You can add columns by right-clicking the fields in the Packet Details pane and select "Apply as Column" from the context menu:
tcp.len
tcp.hdr_len
tcp.analysis.bytes_in_flight

Here you can read more about adding and customizing columns.

answered 22 May '11, 21:11

joke's gravatar image

joke
1.3k4934
accept rate: 9%

edited 22 May '11, 21:16

0

answered 04 Sep '14, 02:46

jayjair's gravatar image

jayjair
1
accept rate: 0%