Because TCP is connection-oriented and stateful, much of Wireshark's analytical power is devoted to inspecting TCP behavior. The six control flags — SYN, ACK, FIN, RST, PSH, and URG — can be tested individually with fields like tcp.flags.syn == 1, tcp.flags.ack == 1, tcp.flags.fin == 1, tcp.flags.rst == 1, tcp.flags.psh == 1, and tcp.flags.urg == 1. Classic connection lifecycle events fall out naturally: a SYN with no ACK (tcp.flags.syn == 1 && tcp.flags.ack == 0) marks a connection initiation, a SYN-ACK (both flags set) marks the server's response, and a FIN (with or without ACK) marks teardown. A complete three-way handshake can therefore be expressed as a single filter combining those three flag combinations.
Wireshark's TCP analysis engine produces a rich set of expert annotations that help diagnose performance and reliability problems. Filters such as tcp.analysis.retransmission, tcp.analysis.fast_retransmission, tcp.analysis.spurious_retransmission, tcp.analysis.duplicate_ack, tcp.analysis.out_of_order, and tcp.analysis.lost_segment expose the symptoms of packet loss, network reordering, and congestion. Flow control issues appear as tcp.analysis.zero_window (the receiver's buffer is full), tcp.window_size == 0, and tcp.analysis.window_update. Keep-alive traffic shows up as tcp.analysis.keep_alive and tcp.analysis.keep_alive_ack, which are useful for distinguishing idle but healthy connections from dead ones.
Beyond flags and analysis events, Wireshark exposes the deeper fields of the TCP header. Sequence and acknowledgment numbers are available as tcp.seq and tcp.ack, the urgent pointer as tcp.urgent_pointer, and the window size as tcp.window_size, which can be combined with relational operators to spot flow-control problems (for example tcp.window_size < 1000). TCP options have their own filter fields, including tcp.options.mss_val, tcp.options.wscale_val, tcp.options.sack_perm, tcp.options.sack, tcp.options.timestamp.tsval, and tcp.options.nop, allowing targeted inspection of negotiated features. A reconstructed view of an entire conversation is available through the Follow TCP Stream feature, which reassembles the application data exchanged between two endpoints into a readable stream.