How can I filter packets for TCP connections with short duration (e.g. 3 seconds)?

I guess there may be something like

ip.addr == xxx.xxx.xxx.xxx && (time(tcp.flags.fin==1) - time(tcp.flags.syn==1)) < 3sec

blahblah, but I cannot make the corrent filter string.


You can go to Statistics -> Conversations, then chose TCP tab and sort conversations by their duration by clicking on Duration. Now you can prepare each conversation or apply it as a filter and follow its stream. Also, you can copy the list using the Copy button.

This way doesn't filter all of the connections altogether by one click, but if there aren't too many connections, you can prepare a filter for each connection and then display them (right-click on each conversation, Prepare a Filter -> ...or Selected .

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.