0

I am trying to find out a way to filter out packets specifying abnormal connection termination in wireshark. I mean is there any tcp.connection.terminated filter in wireshark??

Improve this question
3
  • 2
    An abnormal TCP connection termination is a RST, so you can filter for that.
    – Ron Maupin ♦
    Feb 11, 2020 at 15:22
  • you mean tcp.connection.rst??
    – Vipul Tyagi
    Feb 11, 2020 at 15:23
  • Would you please also tell me whether normal termination is FIN??
    – Vipul Tyagi
    Feb 11, 2020 at 15:28

1 Answer 1

Reset to default
1

TCP FIN is a normal termination.

Abnormal connection terminations would have TCP RST flag enabled: tcp.flags.reset == 1

A connection can also time out (keepalive SYN is sent more than once, no ACK received back).

You can filter for the TCP SYN flag using display filter tcp.flags eq 0x02 and look for connections that do not receive ACK.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.