Skip to content

Chapter 3 of 7

TCP Analysis and Troubleshooting

Because TCP is connection-oriented and stateful, much of Wireshark's analytical power is devoted to inspecting TCP behavior. The six control flags — SYN, ACK, FIN, RST, PSH, and URG — can be tested individually with fields like tcp.flags.syn == 1, tcp.flags.ack == 1, tcp.flags.fin == 1, tcp.flags.rst == 1, tcp.flags.psh == 1, and tcp.flags.urg == 1. Classic connection lifecycle events fall out naturally: a SYN with no ACK (tcp.flags.syn == 1 && tcp.flags.ack == 0) marks a connection initiation, a SYN-ACK (both flags set) marks the server's response, and a FIN (with or without ACK) marks teardown. A complete three-way handshake can therefore be expressed as a single filter combining those three flag combinations.

Wireshark's TCP analysis engine produces a rich set of expert annotations that help diagnose performance and reliability problems. Filters such as tcp.analysis.retransmission, tcp.analysis.fast_retransmission, tcp.analysis.spurious_retransmission, tcp.analysis.duplicate_ack, tcp.analysis.out_of_order, and tcp.analysis.lost_segment expose the symptoms of packet loss, network reordering, and congestion. Flow control issues appear as tcp.analysis.zero_window (the receiver's buffer is full), tcp.window_size == 0, and tcp.analysis.window_update. Keep-alive traffic shows up as tcp.analysis.keep_alive and tcp.analysis.keep_alive_ack, which are useful for distinguishing idle but healthy connections from dead ones.

Beyond flags and analysis events, Wireshark exposes the deeper fields of the TCP header. Sequence and acknowledgment numbers are available as tcp.seq and tcp.ack, the urgent pointer as tcp.urgent_pointer, and the window size as tcp.window_size, which can be combined with relational operators to spot flow-control problems (for example tcp.window_size < 1000). TCP options have their own filter fields, including tcp.options.mss_val, tcp.options.wscale_val, tcp.options.sack_perm, tcp.options.sack, tcp.options.timestamp.tsval, and tcp.options.nop, allowing targeted inspection of negotiated features. A reconstructed view of an entire conversation is available through the Follow TCP Stream feature, which reassembles the application data exchanged between two endpoints into a readable stream.

All chapters
  1. 1Wireshark Fundamentals
  2. 2Protocol-Specific Display Filters
  3. 3TCP Analysis and Troubleshooting
  4. 4Application-Layer Filtering
  5. 5Statistics and Analysis Tools
  6. 6Capture Options and File Handling
  7. 7Command-Line Tools and Workflows

Drill it

Reading is not remembering. These come from the Wireshark Cards deck:

Q

What is Wireshark?

A network protocol analyzer used for network troubleshooting, analysis, software and communications protocol development, and education.

Q

What is the difference between a Capture Filter and a Display Filter?

Capture filters limit what is recorded by Wireshark - Display filters limit what is seen on the screen after capturing.

Q

What is the syntax to filter for IP address 192.168.1.1 in a display filter?

ip.addr == 192.168.1.1

Q

How do you filter for HTTP traffic?

http