Let me start by prefixing my knowledge of Wireshark is very limited.
Context : I'm investigating logs between a server hosted files and an AV that supported ICAP protocol. In this logs I'm very interesting about the string :
Unable to read data from the transport connection: A connection attempt failed because the connected party did not properly respond after a period of time
I though a trace could be a good idea to investigate this logs so I'm using
icap flag to find all record about icap transaction.
As icap is based on the TCP/IP pile my question is :
Should I use
icap and tcp.analysis.flagsas a flag in Wireshark to find bad TCP packet?