Hi, I am aware of three-way handshake protocol in TCP and how SYN, SYN_ACK and FIN helps identify the stages of establishment and teardown. Is there any filter (in wireshark) I can use to get these (ones for establishment) and (ones for teardown) seperately from data packets? asked 13 Oct '16, 09:58  learner_tcp |
One Answer:
Not easily as filters only determine if a particular packet should be displayed or not depending on fields (real or synthesized) in that packet. This makes it difficult to display the final ACK for the connection establishment and teardown as they don't look different from any other ACK. If you have relative sequence numbers on the final ACK for establishment can be located as it will have a sequence number and ack value of 1. This gives a filter of: answered 13 Oct '16, 10:34  grahamb ♦ edited 13 Oct '16, 10:34 |
