Retrive tcp duration using tshark

Question

I would like to know how long the TCP connection lasted using tshark, in wiresahrk this info is represented in the conversation statistics

Answer 1

If you know the TCP stream index for the connection, you can pull out the frame.time_epoch field for the first and last frames and subtract them.

tshark -r <filename> -R "tcp.stream eq <index>" -T fields -e frame.time_epoch

That will print out the arrival times for each packet in the stream. You can subtract the first number from the last to get the total duration as Wireshark would calculate it.