Hi all I have a pcap file that contains many tcp connections, i would like to calculate duration time between tcp syn and ack after Fin-ack for every connection ? thank you for helping us This question is marked "community wiki". asked 06 Nov '15, 03:33  Abo3abbas wikified 06 Nov '15, 05:43 |
One Answer:
Have you tried Statistics -> Conversations -> TCP, looking at the "Duration" column? answered 06 Nov '15, 03:48  Jasper ♦♦ |
So which duration are you looking for?
First one is iRTT, which you can see in the TCP decode in the SEQ/ACK Analysis, the second one is duration usually.
Well, Wireshark separates conversations from SYN to FIN or Reset, so even if you have port reuse, you'll see two conversations then, with a duration each. That should be good enough for most cases.
When you have to deal with missing FIN packets (incomplete conversations) the duration will be wrong, but the only way to verify those is to do it manually.