This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to define NEW and ESTABLISHED TCP packet based on TCP flags? I would think that NEW TCP packet has SYN flag set, ACK flag not set, RST flag not set, FIN flag not set and value of the rest of the flags is not important:

NS CWR ECE URG ACK PSH RST SYN FIN
x  x   x   x   0   x   0   1   0

And ESTABLISHED TCP packets are all the packets with ACK flag set:

NS CWR ECE URG ACK PSH RST SYN FIN
x  x   x   x   1   x   x   x   x

Is this correct?

asked 10 May '17, 04:09

mrtn's gravatar image

mrtn
11669
accept rate: 0%


It can be a bit of a "what's your kind of definition for new/established" thing, but basically you're correct - as soon as the SYN flags are done for, the connection is established and all packets carry ACK flag (but should not have SYN set, or RST, because SYN is "new" again, and RST is abort/shutdown).

permanent link

answered 10 May '17, 04:12

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×12

question asked: 10 May '17, 04:09

question was seen: 657 times

last updated: 10 May '17, 04:12

p​o​w​e​r​e​d by O​S​Q​A