Wireshark
the world's foremost network protocol analyzer
Display Filter Reference: Transmission Control Protocol
Protocol field name: tcp
Versions: 1.0.0 to 1.8.6
Back to Display Filter Reference
| Field name | Type | Description | Versions |
|---|---|---|---|
| tcp.ack | Unsigned integer, 4 bytes | Acknowledgment number | 1.0.0 to 1.8.6 |
| tcp.analysis | Label | SEQ/ACK analysis | 1.8.0 to 1.8.6 |
| tcp.analysis.ack_lost_segment | Label | ACKed Unseen Packet | 1.0.0 to 1.8.6 |
| tcp.analysis.ack_rtt | Time offset | The RTT to ACK the segment was | 1.0.0 to 1.8.6 |
| tcp.analysis.acks_frame | Frame number | This is an ACK to the segment in frame | 1.0.0 to 1.8.6 |
| tcp.analysis.bytes_in_flight | Unsigned integer, 4 bytes | Bytes in flight | 1.2.0 to 1.8.6 |
| tcp.analysis.duplicate_ack | Label | Duplicate ACK | 1.0.0 to 1.8.6 |
| tcp.analysis.duplicate_ack_frame | Frame number | Duplicate to the ACK in frame | 1.0.0 to 1.8.6 |
| tcp.analysis.duplicate_ack_num | Unsigned integer, 4 bytes | Duplicate ACK # | 1.0.0 to 1.8.6 |
| tcp.analysis.fast_retransmission | Label | Fast Retransmission | 1.0.0 to 1.8.6 |
| tcp.analysis.flags | Label | TCP Analysis Flags | 1.0.0 to 1.8.6 |
| tcp.analysis.keep_alive | Label | Keep Alive | 1.0.0 to 1.8.6 |
| tcp.analysis.keep_alive_ack | Label | Keep Alive ACK | 1.0.0 to 1.8.6 |
| tcp.analysis.lost_segment | Label | Previous Segment Unseen | 1.0.0 to 1.8.6 |
| tcp.analysis.out_of_order | Label | Out Of Order | 1.0.0 to 1.8.6 |
| tcp.analysis.retransmission | Label | Retransmission | 1.0.0 to 1.8.6 |
| tcp.analysis.reused_ports | Label | TCP Port numbers reused | 1.0.0 to 1.8.6 |
| tcp.analysis.rto | Time offset | The RTO for this segment was | 1.0.0 to 1.8.6 |
| tcp.analysis.rto_frame | Frame number | RTO based on delta from frame | 1.0.0 to 1.8.6 |
| tcp.analysis.window_full | Label | Window full | 1.0.0 to 1.8.6 |
| tcp.analysis.window_update | Label | Window update | 1.0.0 to 1.8.6 |
| tcp.analysis.zero_window | Label | Zero Window | 1.0.0 to 1.8.6 |
| tcp.analysis.zero_window_probe | Label | Zero Window Probe | 1.0.0 to 1.8.6 |
| tcp.analysis.zero_window_probe_ack | Label | Zero Window Probe Ack | 1.0.0 to 1.8.6 |
| tcp.checksum | Unsigned integer, 2 bytes | Checksum | 1.0.0 to 1.8.6 |
| tcp.checksum_bad | Boolean | Bad Checksum | 1.0.0 to 1.8.6 |
| tcp.checksum_good | Boolean | Good Checksum | 1.0.0 to 1.8.6 |
| tcp.continuation_to | Frame number | This is a continuation to the PDU in frame | 1.0.0 to 1.8.6 |
| tcp.data | Sequence of bytes | TCP segment data | 1.4.5 to 1.8.6 |
| tcp.dstport | Unsigned integer, 2 bytes | Destination Port | 1.0.0 to 1.8.6 |
| tcp.flags | Unsigned integer, 2 bytes | Flags | 1.0.0 to 1.8.6 |
| tcp.flags.ack | Boolean | Acknowledgment | 1.0.0 to 1.8.6 |
| tcp.flags.cwr | Boolean | Congestion Window Reduced (CWR) | 1.0.0 to 1.8.6 |
| tcp.flags.ecn | Boolean | ECN-Echo | 1.0.0 to 1.8.6 |
| tcp.flags.fin | Boolean | Fin | 1.0.0 to 1.8.6 |
| tcp.flags.ns | Boolean | Nonce | 1.4.1 to 1.8.6 |
| tcp.flags.push | Boolean | Push | 1.0.0 to 1.8.6 |
| tcp.flags.res | Boolean | Reserved | 1.4.1 to 1.8.6 |
| tcp.flags.reset | Boolean | Reset | 1.0.0 to 1.8.6 |
| tcp.flags.syn | Boolean | Syn | 1.0.0 to 1.8.6 |
| tcp.flags.urg | Boolean | Urgent | 1.0.0 to 1.8.6 |
| tcp.hdr_len | Unsigned integer, 1 byte | Header Length | 1.0.0 to 1.8.6 |
| tcp.len | Unsigned integer, 4 bytes | TCP Segment Len | 1.0.0 to 1.8.6 |
| tcp.nxtseq | Unsigned integer, 4 bytes | Next sequence number | 1.0.0 to 1.8.6 |
| tcp.option_kind | Unsigned integer, 1 byte | Kind | 1.6.0 to 1.8.6 |
| tcp.option_len | Unsigned integer, 1 byte | Length | 1.6.0 to 1.8.6 |
| tcp.options | Sequence of bytes | TCP Options | 1.0.0 to 1.8.6 |
| tcp.options.cc | Boolean | TCP CC Option | 1.0.0 to 1.8.6 |
| tcp.options.ccecho | Boolean | TCP CC Echo Option | 1.0.0 to 1.8.6 |
| tcp.options.ccnew | Boolean | TCP CC New Option | 1.0.0 to 1.8.6 |
| tcp.options.echo | Boolean | TCP Echo Option | 1.0.0 to 1.8.6 |
| tcp.options.echo_reply | Boolean | TCP Echo Reply Option | 1.0.0 to 1.8.6 |
| tcp.options.experimental | Sequence of bytes | TCP Option - Experimental | 1.8.0 to 1.8.6 |
| tcp.options.experimental.data | Sequence of bytes | Data | 1.8.0 to 1.8.6 |
| tcp.options.md5 | Boolean | TCP MD5 Option | 1.0.0 to 1.8.6 |
| tcp.options.mood | Boolean | TCP Mood Option | 1.4.0 to 1.4.10, 1.6.0 to 1.6.4 |
| tcp.options.mood_val | Character string | TCP Mood Option Value | 1.4.0 to 1.4.10, 1.6.0 to 1.6.4 |
| tcp.options.mptcp.addrid | Unsigned integer, 1 byte | Multipath TCP Address ID | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.backup.flag | Unsigned integer, 1 byte | Backup flag | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.checksum | Unsigned integer, 2 bytes | Multipath TCP Checksum | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.checksumreq.flags | Unsigned integer, 1 byte | Checksum required | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.dataack | Unsigned integer, 8 bytes | Multipath TCP Data ACK | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.dataack8.flag | Unsigned integer, 1 byte | Data ACK is 8 octets | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.dataackpresent.flag | Unsigned integer, 1 byte | Data ACK is present | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.datafin.flag | Unsigned integer, 1 byte | DATA_FIN | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.datalvllen | Unsigned integer, 2 bytes | Multipath TCP Data-level Length | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.dataseqno | Unsigned integer, 8 bytes | Multipath TCP Data Sequence Number | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.dseqn8.flag | Unsigned integer, 1 byte | Data Sequence Number is 8 octets | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.dseqnpresent.flag | Unsigned integer, 1 byte | Data Sequence Number, Subflow Sequence Number, Data-level Length, Checksum present | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.flags | Unsigned integer, 1 byte | Multipath TCP flags | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.ipv4 | IPv4 address | Multipath TCP Address | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.ipv6 | IPv6 address | Multipath TCP Address | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.ipver | Unsigned integer, 1 byte | Multipath TCP IPVer | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.port | Unsigned integer, 2 bytes | Multipath TCP Port | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.recvkey | Unsigned integer, 8 bytes | Multipath TCP Receiver's Key | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.recvtok | Unsigned integer, 4 bytes | Multipath TCP Receiver's Token | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.sendkey | Unsigned integer, 8 bytes | Multipath TCP Sender's Key | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.sendmac | Unsigned integer, 4 bytes | Multipath TCP Sender's MAC | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.sendrand | Unsigned integer, 4 bytes | Multipath TCP Sender's Random Number | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.sendtruncmac | Unsigned integer, 8 bytes | Multipath TCP Sender's Truncated MAC | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.sha1.flag | Unsigned integer, 1 byte | Use HMAC-SHA1 | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.subflowseqno | Unsigned integer, 4 bytes | Multipath TCP Subflow Sequence Number | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.subtype | Unsigned integer, 1 byte | Multipath TCP subtype | 1.8.0 to 1.8.6 |
| tcp.options.mptcp.version | Unsigned integer, 1 byte | Multipath TCP version | 1.8.0 to 1.8.6 |
| tcp.options.mss | Label | TCP MSS Option | 1.0.0 to 1.8.6 |
| tcp.options.mss_val | Unsigned integer, 2 bytes | MSS Value | 1.0.0 to 1.8.6 |
| tcp.options.qs | Boolean | TCP QS Option | 1.0.0 to 1.8.6 |
| tcp.options.rvbd.probe | Boolean | Riverbed Probe | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.appli_ver | Unsigned integer, 2 bytes | Application Version | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.client.ip | IPv4 address | Client IP | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.flags | Unsigned integer, 1 byte | Probe Flags | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.flags.last | Boolean | Last Notify | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.flags.notcfe | Boolean | Not CFE | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.flags.probe | Boolean | Disable Probe Cache on CSH | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.flags.server | Boolean | SSH outer to server established | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.flags.ssl | Boolean | SSL Enabled | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.len | Unsigned integer, 1 byte | Length | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.prober | IPv4 address | CSH IP | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.proxy.ip | IPv4 address | SSH IP | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.proxy.port | Unsigned integer, 2 bytes | SSH Port | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.storeid | Unsigned integer, 4 bytes | CFE Store ID | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.type1 | Unsigned integer, 1 byte | Type | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.type2 | Unsigned integer, 1 byte | Type | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.version | Unsigned integer, 1 byte | Version | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.probe.version_raw | Unsigned integer, 1 byte | Version | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy | Boolean | Riverbed Transparency | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.client.port | Unsigned integer, 2 bytes | Out of band connection Client Port | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.dst.ip | IPv4 address | Dst SH IP Addr | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.dst.port | Unsigned integer, 2 bytes | Dst SH Inner Port | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.flags | Unsigned integer, 2 bytes | Transparency Options | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.flags.chksum | Boolean | Reserved | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.flags.fw_rst | Boolean | Enable Transparency FW feature on All FWs | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.flags.fw_rst_inner | Boolean | Enable Inner FW feature on All FWs | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.flags.fw_rst_probe | Boolean | Enable FW traversal feature | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.flags.mode | Boolean | Transparency Mode | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.flags.oob | Boolean | Out of band connection | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.src.ip | IPv4 address | Src SH IP Addr | 1.6.0 to 1.8.6 |
| tcp.options.rvbd.trpy.src.port | Unsigned integer, 2 bytes | Src SH Inner Port | 1.6.0 to 1.8.6 |
| tcp.options.sack | Boolean | TCP SACK Option | 1.0.0 to 1.8.6 |
| tcp.options.sack_le | Unsigned integer, 4 bytes | TCP SACK Left Edge | 1.0.0 to 1.8.6 |
| tcp.options.sack_perm | Boolean | TCP SACK Permitted Option | 1.0.0 to 1.8.6 |
| tcp.options.sack_re | Unsigned integer, 4 bytes | TCP SACK Right Edge | 1.0.0 to 1.8.6 |
| tcp.options.scps | Boolean | TCP SCPS Capabilities Option | 1.2.0 to 1.8.6 |
| tcp.options.scps.binding | Unsigned integer, 1 byte | Connection ID | 1.2.0 to 1.8.6 |
| tcp.options.scps.binding.id | Unsigned integer, 1 byte | Binding Space (Community) ID | 1.4.9 to 1.4.15, 1.6.2 to 1.8.6 |
| tcp.options.scps.binding.len | Unsigned integer, 1 byte | Extended Capability Length | 1.4.9 to 1.4.15, 1.6.2 to 1.8.6 |
| tcp.options.scps.vector | Unsigned integer, 1 byte | TCP SCPS Capabilities Vector | 1.2.0 to 1.8.6 |
| tcp.options.scpsflags.bets | Boolean | Partial Reliability Capable (BETS) | 1.2.0 to 1.8.6 |
| tcp.options.scpsflags.compress | Boolean | Lossless Header Compression (COMP) | 1.2.0 to 1.8.6 |
| tcp.options.scpsflags.nlts | Boolean | Network Layer Timestamp (NLTS) | 1.2.0 to 1.8.6 |
| tcp.options.scpsflags.reserved | Unsigned integer, 1 byte | Reserved | 1.4.11 to 1.4.15, 1.6.5 to 1.8.6 |
| tcp.options.scpsflags.reserved1 | Boolean | Reserved Bit 1 | 1.2.0 to 1.4.10, 1.6.0 to 1.6.4 |
| tcp.options.scpsflags.reserved2 | Boolean | Reserved Bit 2 | 1.2.0 to 1.4.10, 1.6.0 to 1.6.4 |
| tcp.options.scpsflags.reserved3 | Boolean | Reserved Bit 3 | 1.2.0 to 1.4.10, 1.6.0 to 1.6.4 |
| tcp.options.scpsflags.snack1 | Boolean | Short Form SNACK Capable (SNACK1) | 1.2.0 to 1.8.6 |
| tcp.options.scpsflags.snack2 | Boolean | Long Form SNACK Capable (SNACK2) | 1.2.0 to 1.8.6 |
| tcp.options.snack | Boolean | TCP Selective Negative Acknowledgment Option | 1.2.0 to 1.8.6 |
| tcp.options.snack.le | Unsigned integer, 2 bytes | TCP SNACK Left Edge | 1.2.0 to 1.8.6 |
| tcp.options.snack.offset | Unsigned integer, 2 bytes | TCP SNACK Offset | 1.2.0 to 1.8.6 |
| tcp.options.snack.re | Unsigned integer, 2 bytes | TCP SNACK Right Edge | 1.2.0 to 1.8.6 |
| tcp.options.snack.size | Unsigned integer, 2 bytes | TCP SNACK Size | 1.2.0 to 1.8.6 |
| tcp.options.time_stamp | Boolean | TCP Time Stamp Option | 1.0.0 to 1.4.15 |
| tcp.options.timestamp.tsecr | Unsigned integer, 4 bytes | Timestamp echo reply | 1.6.0 to 1.8.6 |
| tcp.options.timestamp.tsval | Unsigned integer, 4 bytes | Timestamp value | 1.6.0 to 1.8.6 |
| tcp.options.user_to | Boolean | TCP User Timeout | 1.6.0 to 1.8.6 |
| tcp.options.user_to_granularity | Boolean | Granularity | 1.6.0 to 1.8.6 |
| tcp.options.user_to_val | Unsigned integer, 2 bytes | User Timeout | 1.6.0 to 1.8.6 |
| tcp.options.wscale | Boolean | TCP Window Scale Option | 1.0.0 to 1.4.15 |
| tcp.options.wscale.multiplier | Unsigned integer, 1 byte | Multiplier | 1.6.0 to 1.8.6 |
| tcp.options.wscale.shift | Unsigned integer, 1 byte | Shift count | 1.6.0 to 1.8.6 |
| tcp.options.wscale_val | Unsigned integer, 1 byte | TCP Windows Scale Option Value | 1.0.0 to 1.4.15 |
| tcp.pdu.last_frame | Frame number | Last frame of this PDU | 1.0.0 to 1.8.6 |
| tcp.pdu.size | Unsigned integer, 4 bytes | PDU Size | 1.0.0 to 1.8.6 |
| tcp.pdu.time | Time offset | Time until the last segment of this PDU | 1.0.0 to 1.8.6 |
| tcp.port | Unsigned integer, 2 bytes | Source or Destination Port | 1.0.0 to 1.8.6 |
| tcp.proc.dstcmd | Character string | Destination process name | 1.2.0 to 1.8.6 |
| tcp.proc.dstpid | Unsigned integer, 4 bytes | Destination process ID | 1.2.0 to 1.8.6 |
| tcp.proc.dstuid | Unsigned integer, 4 bytes | Destination process user ID | 1.2.0 to 1.8.6 |
| tcp.proc.dstuname | Character string | Destination process user name | 1.2.0 to 1.8.6 |
| tcp.proc.srccmd | Character string | Source process name | 1.2.0 to 1.8.6 |
| tcp.proc.srcpid | Unsigned integer, 4 bytes | Source process ID | 1.2.0 to 1.8.6 |
| tcp.proc.srcuid | Unsigned integer, 4 bytes | Source process user ID | 1.2.0 to 1.8.6 |
| tcp.proc.srcuname | Character string | Source process user name | 1.2.0 to 1.8.6 |
| tcp.reassembled.length | Unsigned integer, 4 bytes | Reassembled TCP length | 1.4.0 to 1.8.6 |
| tcp.reassembled_in | Frame number | Reassembled PDU in frame | 1.0.0 to 1.8.6 |
| tcp.segment | Frame number | TCP Segment | 1.0.0 to 1.8.6 |
| tcp.segment.count | Unsigned integer, 4 bytes | Segment count | 1.6.0 to 1.8.6 |
| tcp.segment.error | Frame number | Reassembling error | 1.0.0 to 1.8.6 |
| tcp.segment.multipletails | Boolean | Multiple tail segments found | 1.0.0 to 1.8.6 |
| tcp.segment.overlap | Boolean | Segment overlap | 1.0.0 to 1.8.6 |
| tcp.segment.overlap.conflict | Boolean | Conflicting data in segment overlap | 1.0.0 to 1.8.6 |
| tcp.segment.toolongfragment | Boolean | Segment too long | 1.0.0 to 1.8.6 |
| tcp.segments | Label | Reassembled TCP Segments | 1.0.0 to 1.8.6 |
| tcp.seq | Unsigned integer, 4 bytes | Sequence number | 1.0.0 to 1.8.6 |
| tcp.srcport | Unsigned integer, 2 bytes | Source Port | 1.0.0 to 1.8.6 |
| tcp.stream | Unsigned integer, 4 bytes | Stream index | 1.2.0 to 1.8.6 |
| tcp.time_delta | Time offset | Time since previous frame in this TCP stream | 1.0.0 to 1.8.6 |
| tcp.time_relative | Time offset | Time since first frame in this TCP stream | 1.0.0 to 1.8.6 |
| tcp.urgent_pointer | Unsigned integer, 2 bytes | Urgent pointer | 1.0.0 to 1.8.6 |
| tcp.window_size | Unsigned integer, 4 bytes | Calculated window size | 1.0.0 to 1.8.6 |
| tcp.window_size_scalefactor | Signed integer, 4 bytes | Window size scaling factor | 1.6.0 to 1.8.6 |
| tcp.window_size_value | Unsigned integer, 2 bytes | Window size value | 1.6.0 to 1.8.6 |