Display Filter Reference: Transmission Control Protocol

Protocol field name: tcp

Versions: 1.0.0 to 1.10.6

Back to Display Filter Reference

Field name Description Type Versions
tcp.ack Acknowledgment number Unsigned integer, 4 bytes 1.0.0 to 1.10.6
tcp.analysis SEQ/ACK analysis Label 1.8.0 to 1.10.6
tcp.analysis.ack_lost_segment ACKed Unseen Packet Label 1.0.0 to 1.10.6
tcp.analysis.ack_rtt The RTT to ACK the segment was Time offset 1.0.0 to 1.10.6
tcp.analysis.acks_frame This is an ACK to the segment in frame Frame number 1.0.0 to 1.10.6
tcp.analysis.bytes_in_flight Bytes in flight Unsigned integer, 4 bytes 1.2.0 to 1.10.6
tcp.analysis.duplicate_ack Duplicate ACK Label 1.0.0 to 1.10.6
tcp.analysis.duplicate_ack_frame Duplicate to the ACK in frame Frame number 1.0.0 to 1.10.6
tcp.analysis.duplicate_ack_num Duplicate ACK # Unsigned integer, 4 bytes 1.0.0 to 1.10.6
tcp.analysis.fast_retransmission Fast Retransmission Label 1.0.0 to 1.10.6
tcp.analysis.flags TCP Analysis Flags Label 1.0.0 to 1.10.6
tcp.analysis.keep_alive Keep Alive Label 1.0.0 to 1.10.6
tcp.analysis.keep_alive_ack Keep Alive ACK Label 1.0.0 to 1.10.6
tcp.analysis.lost_segment Previous Segment Unseen Label 1.0.0 to 1.10.6
tcp.analysis.out_of_order Out Of Order Label 1.0.0 to 1.10.6
tcp.analysis.retransmission Retransmission Label 1.0.0 to 1.10.6
tcp.analysis.reused_ports TCP Port numbers reused Label 1.0.0 to 1.10.6
tcp.analysis.rto The RTO for this segment was Time offset 1.0.0 to 1.10.6
tcp.analysis.rto_frame RTO based on delta from frame Frame number 1.0.0 to 1.10.6
tcp.analysis.window_full Window full Label 1.0.0 to 1.10.6
tcp.analysis.window_update Window update Label 1.0.0 to 1.10.6
tcp.analysis.zero_window Zero Window Label 1.0.0 to 1.10.6
tcp.analysis.zero_window_probe Zero Window Probe Label 1.0.0 to 1.10.6
tcp.analysis.zero_window_probe_ack Zero Window Probe Ack Label 1.0.0 to 1.10.6
tcp.checksum Checksum Unsigned integer, 2 bytes 1.0.0 to 1.10.6
tcp.checksum_bad Bad Checksum Boolean 1.0.0 to 1.10.6
tcp.checksum_good Good Checksum Boolean 1.0.0 to 1.10.6
tcp.continuation_to This is a continuation to the PDU in frame Frame number 1.0.0 to 1.10.6
tcp.data TCP segment data Sequence of bytes 1.4.5 to 1.8.13
tcp.dstport Destination Port Unsigned integer, 2 bytes 1.0.0 to 1.10.6
tcp.flags Flags Unsigned integer, 2 bytes 1.0.0 to 1.10.6
tcp.flags.ack Acknowledgment Boolean 1.0.0 to 1.10.6
tcp.flags.cwr Congestion Window Reduced (CWR) Boolean 1.0.0 to 1.10.6
tcp.flags.ecn ECN-Echo Boolean 1.0.0 to 1.10.6
tcp.flags.fin Fin Boolean 1.0.0 to 1.10.6
tcp.flags.ns Nonce Boolean 1.4.1 to 1.10.6
tcp.flags.push Push Boolean 1.0.0 to 1.10.6
tcp.flags.res Reserved Boolean 1.4.1 to 1.10.6
tcp.flags.reset Reset Boolean 1.0.0 to 1.10.6
tcp.flags.syn Syn Boolean 1.0.0 to 1.10.6
tcp.flags.urg Urgent Boolean 1.0.0 to 1.10.6
tcp.hdr_len Header Length Unsigned integer, 1 byte 1.0.0 to 1.10.6
tcp.len TCP Segment Len Unsigned integer, 4 bytes 1.0.0 to 1.10.6
tcp.nxtseq Next sequence number Unsigned integer, 4 bytes 1.0.0 to 1.10.6
tcp.option_kind Kind Unsigned integer, 1 byte 1.6.0 to 1.10.6
tcp.option_len Length Unsigned integer, 1 byte 1.6.0 to 1.10.6
tcp.options TCP Options Sequence of bytes 1.0.0 to 1.10.6
tcp.options.cc TCP CC Option Boolean 1.0.0 to 1.10.6
tcp.options.ccecho TCP CC Echo Option Boolean 1.0.0 to 1.8.13
tcp.options.ccnew TCP CC New Option Boolean 1.0.0 to 1.8.13
tcp.options.echo TCP Echo Option Boolean 1.0.0 to 1.10.6
tcp.options.echo_reply TCP Echo Reply Option Boolean 1.0.0 to 1.8.13
tcp.options.experimental TCP Option - Experimental Sequence of bytes 1.8.0 to 1.10.6
tcp.options.experimental.data Data Sequence of bytes 1.8.0 to 1.10.6
tcp.options.experimental.magic_number Magic Number Unsigned integer, 2 bytes 1.10.0 to 1.10.6
tcp.options.md5 TCP MD5 Option Boolean 1.0.0 to 1.8.13
tcp.options.mood TCP Mood Option Boolean 1.4.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.mood_val TCP Mood Option Value Character string 1.4.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.mptcp.addrid Multipath TCP Address ID Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.backup.flag Backup flag Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.checksum Multipath TCP Checksum Unsigned integer, 2 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.checksumreq.flags Checksum required Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.dataack Multipath TCP Data ACK Unsigned integer, 8 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.dataack8.flag Data ACK is 8 octets Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.dataackpresent.flag Data ACK is present Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.datafin.flag DATA_FIN Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.datalvllen Multipath TCP Data-level Length Unsigned integer, 2 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.dataseqno Multipath TCP Data Sequence Number Unsigned integer, 8 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.dseqn8.flag Data Sequence Number is 8 octets Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.dseqnpresent.flag Data Sequence Number, Subflow Sequence Number, Data-level Length, Checksum present Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.flags Multipath TCP flags Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.ipv4 Multipath TCP Address IPv4 address 1.8.0 to 1.10.6
tcp.options.mptcp.ipv6 Multipath TCP Address IPv6 address 1.8.0 to 1.10.6
tcp.options.mptcp.ipver Multipath TCP IPVer Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.port Multipath TCP Port Unsigned integer, 2 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.recvkey Multipath TCP Receiver\'s Key Unsigned integer, 8 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.recvtok Multipath TCP Receiver\'s Token Unsigned integer, 4 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.sendkey Multipath TCP Sender\'s Key Unsigned integer, 8 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.sendmac Multipath TCP Sender\'s MAC Unsigned integer, 4 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.sendrand Multipath TCP Sender\'s Random Number Unsigned integer, 4 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.sendtruncmac Multipath TCP Sender\'s Truncated MAC Unsigned integer, 8 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.sha1.flag Use HMAC-SHA1 Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.subflowseqno Multipath TCP Subflow Sequence Number Unsigned integer, 4 bytes 1.8.0 to 1.10.6
tcp.options.mptcp.subtype Multipath TCP subtype Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mptcp.version Multipath TCP version Unsigned integer, 1 byte 1.8.0 to 1.10.6
tcp.options.mss TCP MSS Option Label 1.0.0 to 1.10.6
tcp.options.mss_val MSS Value Unsigned integer, 2 bytes 1.0.0 to 1.10.6
tcp.options.qs TCP QS Option Boolean 1.0.0 to 1.10.6
tcp.options.rvbd.probe Riverbed Probe Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.probe.appli_ver Application Version Unsigned integer, 2 bytes 1.6.0 to 1.10.6
tcp.options.rvbd.probe.client.ip Client IP IPv4 address 1.6.0 to 1.10.6
tcp.options.rvbd.probe.flags Probe Flags Unsigned integer, 1 byte 1.6.0 to 1.10.6
tcp.options.rvbd.probe.flags.last Last Notify Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.probe.flags.notcfe Not CFE Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.probe.flags.probe Disable Probe Cache on CSH Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.probe.flags.server SSH outer to server established Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.probe.flags.ssl SSL Enabled Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.probe.len Length Unsigned integer, 1 byte 1.6.0 to 1.10.6
tcp.options.rvbd.probe.prober CSH IP IPv4 address 1.6.0 to 1.10.6
tcp.options.rvbd.probe.proxy.ip SSH IP IPv4 address 1.6.0 to 1.10.6
tcp.options.rvbd.probe.proxy.port SSH Port Unsigned integer, 2 bytes 1.6.0 to 1.10.6
tcp.options.rvbd.probe.storeid CFE Store ID Unsigned integer, 4 bytes 1.6.0 to 1.10.6
tcp.options.rvbd.probe.type1 Type Unsigned integer, 1 byte 1.6.0 to 1.10.6
tcp.options.rvbd.probe.type2 Type Unsigned integer, 1 byte 1.6.0 to 1.10.6
tcp.options.rvbd.probe.version Version Unsigned integer, 1 byte 1.6.0 to 1.10.6
tcp.options.rvbd.probe.version_raw Version Unsigned integer, 1 byte 1.6.0 to 1.10.6
tcp.options.rvbd.trpy Riverbed Transparency Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.client.port Out of band connection Client Port Unsigned integer, 2 bytes 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.dst.ip Dst SH IP Addr IPv4 address 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.dst.port Dst SH Inner Port Unsigned integer, 2 bytes 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.flags Transparency Options Unsigned integer, 2 bytes 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.flags.chksum Reserved Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.flags.fw_rst Enable Transparency FW feature on All FWs Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.flags.fw_rst_inner Enable Inner FW feature on All FWs Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.flags.fw_rst_probe Enable FW traversal feature Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.flags.mode Transparency Mode Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.flags.oob Out of band connection Boolean 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.src.ip Src SH IP Addr IPv4 address 1.6.0 to 1.10.6
tcp.options.rvbd.trpy.src.port Src SH Inner Port Unsigned integer, 2 bytes 1.6.0 to 1.10.6
tcp.options.sack TCP SACK Option Boolean 1.0.0 to 1.10.6
tcp.options.sack.count TCP SACK Count Unsigned integer, 1 byte 1.10.0 to 1.10.6
tcp.options.sack_le TCP SACK Left Edge Unsigned integer, 4 bytes 1.0.0 to 1.10.6
tcp.options.sack_perm TCP SACK Permitted Option Boolean 1.0.0 to 1.10.6
tcp.options.sack_re TCP SACK Right Edge Unsigned integer, 4 bytes 1.0.0 to 1.10.6
tcp.options.scps TCP SCPS Capabilities Option Boolean 1.2.0 to 1.10.6
tcp.options.scps.binding Connection ID Unsigned integer, 1 byte 1.2.0 to 1.10.6
tcp.options.scps.binding.id Binding Space (Community) ID Unsigned integer, 1 byte 1.4.9 to 1.4.15, 1.6.2 to 1.10.6
tcp.options.scps.binding.len Extended Capability Length Unsigned integer, 1 byte 1.4.9 to 1.4.15, 1.6.2 to 1.10.6
tcp.options.scps.vector TCP SCPS Capabilities Vector Unsigned integer, 1 byte 1.2.0 to 1.10.6
tcp.options.scpsflags.bets Partial Reliability Capable (BETS) Boolean 1.2.0 to 1.10.6
tcp.options.scpsflags.compress Lossless Header Compression (COMP) Boolean 1.2.0 to 1.10.6
tcp.options.scpsflags.nlts Network Layer Timestamp (NLTS) Boolean 1.2.0 to 1.10.6
tcp.options.scpsflags.reserved Reserved Unsigned integer, 1 byte 1.4.11 to 1.4.15, 1.6.5 to 1.10.6
tcp.options.scpsflags.reserved1 Reserved Bit 1 Boolean 1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.reserved2 Reserved Bit 2 Boolean 1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.reserved3 Reserved Bit 3 Boolean 1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.snack1 Short Form SNACK Capable (SNACK1) Boolean 1.2.0 to 1.10.6
tcp.options.scpsflags.snack2 Long Form SNACK Capable (SNACK2) Boolean 1.2.0 to 1.10.6
tcp.options.snack TCP Selective Negative Acknowledgment Option Boolean 1.2.0 to 1.10.6
tcp.options.snack.le TCP SNACK Left Edge Unsigned integer, 2 bytes 1.2.0 to 1.10.6
tcp.options.snack.offset TCP SNACK Offset Unsigned integer, 2 bytes 1.2.0 to 1.10.6
tcp.options.snack.re TCP SNACK Right Edge Unsigned integer, 2 bytes 1.2.0 to 1.10.6
tcp.options.snack.size TCP SNACK Size Unsigned integer, 2 bytes 1.2.0 to 1.10.6
tcp.options.tfo Fast Open Label 1.10.0 to 1.10.6
tcp.options.tfo.cookie Fast Open Cookie Sequence of bytes 1.10.0 to 1.10.6
tcp.options.tfo.request Fast Open Cookie Request Label 1.10.0 to 1.10.6
tcp.options.time_stamp TCP Time Stamp Option Boolean 1.0.0 to 1.4.15
tcp.options.timestamp.tsecr Timestamp echo reply Unsigned integer, 4 bytes 1.6.0 to 1.10.6
tcp.options.timestamp.tsval Timestamp value Unsigned integer, 4 bytes 1.6.0 to 1.10.6
tcp.options.type Type Unsigned integer, 1 byte 1.10.1 to 1.10.6
tcp.options.type.class Class Unsigned integer, 1 byte 1.10.1 to 1.10.6
tcp.options.type.copy Copy on fragmentation Boolean 1.10.1 to 1.10.6
tcp.options.type.number Number Unsigned integer, 1 byte 1.10.1 to 1.10.6
tcp.options.user_to TCP User Timeout Boolean 1.6.0 to 1.10.6
tcp.options.user_to_granularity Granularity Boolean 1.6.0 to 1.10.6
tcp.options.user_to_val User Timeout Unsigned integer, 2 bytes 1.6.0 to 1.10.6
tcp.options.wscale TCP Window Scale Option Boolean 1.0.0 to 1.4.15
tcp.options.wscale.multiplier Multiplier Unsigned integer, 1 byte 1.6.0 to 1.10.6
tcp.options.wscale.shift Shift count Unsigned integer, 1 byte 1.6.0 to 1.10.6
tcp.options.wscale_val TCP Windows Scale Option Value Unsigned integer, 1 byte 1.0.0 to 1.4.15
tcp.pdu.last_frame Last frame of this PDU Frame number 1.0.0 to 1.10.6
tcp.pdu.size PDU Size Unsigned integer, 4 bytes 1.0.0 to 1.10.6
tcp.pdu.time Time until the last segment of this PDU Time offset 1.0.0 to 1.10.6
tcp.port Source or Destination Port Unsigned integer, 2 bytes 1.0.0 to 1.10.6
tcp.proc.dstcmd Destination process name Character string 1.2.0 to 1.10.6
tcp.proc.dstpid Destination process ID Unsigned integer, 4 bytes 1.2.0 to 1.10.6
tcp.proc.dstuid Destination process user ID Unsigned integer, 4 bytes 1.2.0 to 1.10.6
tcp.proc.dstuname Destination process user name Character string 1.2.0 to 1.10.6
tcp.proc.srccmd Source process name Character string 1.2.0 to 1.10.6
tcp.proc.srcpid Source process ID Unsigned integer, 4 bytes 1.2.0 to 1.10.6
tcp.proc.srcuid Source process user ID Unsigned integer, 4 bytes 1.2.0 to 1.10.6
tcp.proc.srcuname Source process user name Character string 1.2.0 to 1.10.6
tcp.reassembled.data Reassembled TCP Data Sequence of bytes 1.10.0 to 1.10.6
tcp.reassembled.length Reassembled TCP length Unsigned integer, 4 bytes 1.4.0 to 1.10.6
tcp.reassembled_in Reassembled PDU in frame Frame number 1.0.0 to 1.10.6
tcp.segment TCP Segment Frame number 1.0.0 to 1.10.6
tcp.segment.count Segment count Unsigned integer, 4 bytes 1.6.0 to 1.10.6
tcp.segment.error Reassembling error Frame number 1.0.0 to 1.10.6
tcp.segment.multipletails Multiple tail segments found Boolean 1.0.0 to 1.10.6
tcp.segment.overlap Segment overlap Boolean 1.0.0 to 1.10.6
tcp.segment.overlap.conflict Conflicting data in segment overlap Boolean 1.0.0 to 1.10.6
tcp.segment.toolongfragment Segment too long Boolean 1.0.0 to 1.10.6
tcp.segment_data TCP segment data Sequence of bytes 1.10.0 to 1.10.6
tcp.segments Reassembled TCP Segments Label 1.0.0 to 1.10.6
tcp.seq Sequence number Unsigned integer, 4 bytes 1.0.0 to 1.10.6
tcp.srcport Source Port Unsigned integer, 2 bytes 1.0.0 to 1.10.6
tcp.stream Stream index Unsigned integer, 4 bytes 1.2.0 to 1.10.6
tcp.time_delta Time since previous frame in this TCP stream Time offset 1.0.0 to 1.10.6
tcp.time_relative Time since first frame in this TCP stream Time offset 1.0.0 to 1.10.6
tcp.urgent_pointer Urgent pointer Unsigned integer, 2 bytes 1.0.0 to 1.10.6
tcp.window_size Calculated window size Unsigned integer, 4 bytes 1.0.0 to 1.10.6
tcp.window_size_scalefactor Window size scaling factor Signed integer, 4 bytes 1.6.0 to 1.10.6
tcp.window_size_value Window size value Unsigned integer, 2 bytes 1.6.0 to 1.10.6
Enhance Wireshark

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products.

Troubleshoot your Network

Free 30 day trial

Free 30 day trial

  • Save hours on network and application issue diagnoses
  • Monitor physical and virtual environments
  • GUI packet capture and analysis
  • Fully integrated with Wireshark

Try Cascade Shark VE & Cascade Pilot Free for 30 Days

802.11 Packet Capture

Riverbed AirPcap
  • WLAN packet capture and transmission
  • Full 802.11 a/b/g/n support
  • View management, control and data frames
  • Multi-channel aggregation (with multiple adapters)

Learn More

Buy Now

Packet Analysis Made Easy

    Cascade Pilot Personal Edition graphs
  • Visually rich, powerful LAN analyzer
  • Quickly access very large pcap files
  • Professional, customizable reports
  • Advanced triggers and alerts
  • Fully integrated with Wireshark

Try Cascade Pilot PE FREE for 10 days

Buy Now