Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Display Filter Reference: Transmission Control Protocol

Protocol field name: tcp
Versions: 1.0.0 to 1.8.6

Back to Display Filter Reference

Field name Type Description Versions
tcp.ack Unsigned integer, 4 bytes Acknowledgment number 1.0.0 to 1.8.6
tcp.analysis Label SEQ/ACK analysis 1.8.0 to 1.8.6
tcp.analysis.ack_lost_segment Label ACKed Unseen Packet 1.0.0 to 1.8.6
tcp.analysis.ack_rtt Time offset The RTT to ACK the segment was 1.0.0 to 1.8.6
tcp.analysis.acks_frame Frame number This is an ACK to the segment in frame 1.0.0 to 1.8.6
tcp.analysis.bytes_in_flight Unsigned integer, 4 bytes Bytes in flight 1.2.0 to 1.8.6
tcp.analysis.duplicate_ack Label Duplicate ACK 1.0.0 to 1.8.6
tcp.analysis.duplicate_ack_frame Frame number Duplicate to the ACK in frame 1.0.0 to 1.8.6
tcp.analysis.duplicate_ack_num Unsigned integer, 4 bytes Duplicate ACK # 1.0.0 to 1.8.6
tcp.analysis.fast_retransmission Label Fast Retransmission 1.0.0 to 1.8.6
tcp.analysis.flags Label TCP Analysis Flags 1.0.0 to 1.8.6
tcp.analysis.keep_alive Label Keep Alive 1.0.0 to 1.8.6
tcp.analysis.keep_alive_ack Label Keep Alive ACK 1.0.0 to 1.8.6
tcp.analysis.lost_segment Label Previous Segment Unseen 1.0.0 to 1.8.6
tcp.analysis.out_of_order Label Out Of Order 1.0.0 to 1.8.6
tcp.analysis.retransmission Label Retransmission 1.0.0 to 1.8.6
tcp.analysis.reused_ports Label TCP Port numbers reused 1.0.0 to 1.8.6
tcp.analysis.rto Time offset The RTO for this segment was 1.0.0 to 1.8.6
tcp.analysis.rto_frame Frame number RTO based on delta from frame 1.0.0 to 1.8.6
tcp.analysis.window_full Label Window full 1.0.0 to 1.8.6
tcp.analysis.window_update Label Window update 1.0.0 to 1.8.6
tcp.analysis.zero_window Label Zero Window 1.0.0 to 1.8.6
tcp.analysis.zero_window_probe Label Zero Window Probe 1.0.0 to 1.8.6
tcp.analysis.zero_window_probe_ack Label Zero Window Probe Ack 1.0.0 to 1.8.6
tcp.checksum Unsigned integer, 2 bytes Checksum 1.0.0 to 1.8.6
tcp.checksum_bad Boolean Bad Checksum 1.0.0 to 1.8.6
tcp.checksum_good Boolean Good Checksum 1.0.0 to 1.8.6
tcp.continuation_to Frame number This is a continuation to the PDU in frame 1.0.0 to 1.8.6
tcp.data Sequence of bytes TCP segment data 1.4.5 to 1.8.6
tcp.dstport Unsigned integer, 2 bytes Destination Port 1.0.0 to 1.8.6
tcp.flags Unsigned integer, 2 bytes Flags 1.0.0 to 1.8.6
tcp.flags.ack Boolean Acknowledgment 1.0.0 to 1.8.6
tcp.flags.cwr Boolean Congestion Window Reduced (CWR) 1.0.0 to 1.8.6
tcp.flags.ecn Boolean ECN-Echo 1.0.0 to 1.8.6
tcp.flags.fin Boolean Fin 1.0.0 to 1.8.6
tcp.flags.ns Boolean Nonce 1.4.1 to 1.8.6
tcp.flags.push Boolean Push 1.0.0 to 1.8.6
tcp.flags.res Boolean Reserved 1.4.1 to 1.8.6
tcp.flags.reset Boolean Reset 1.0.0 to 1.8.6
tcp.flags.syn Boolean Syn 1.0.0 to 1.8.6
tcp.flags.urg Boolean Urgent 1.0.0 to 1.8.6
tcp.hdr_len Unsigned integer, 1 byte Header Length 1.0.0 to 1.8.6
tcp.len Unsigned integer, 4 bytes TCP Segment Len 1.0.0 to 1.8.6
tcp.nxtseq Unsigned integer, 4 bytes Next sequence number 1.0.0 to 1.8.6
tcp.option_kind Unsigned integer, 1 byte Kind 1.6.0 to 1.8.6
tcp.option_len Unsigned integer, 1 byte Length 1.6.0 to 1.8.6
tcp.options Sequence of bytes TCP Options 1.0.0 to 1.8.6
tcp.options.cc Boolean TCP CC Option 1.0.0 to 1.8.6
tcp.options.ccecho Boolean TCP CC Echo Option 1.0.0 to 1.8.6
tcp.options.ccnew Boolean TCP CC New Option 1.0.0 to 1.8.6
tcp.options.echo Boolean TCP Echo Option 1.0.0 to 1.8.6
tcp.options.echo_reply Boolean TCP Echo Reply Option 1.0.0 to 1.8.6
tcp.options.experimental Sequence of bytes TCP Option - Experimental 1.8.0 to 1.8.6
tcp.options.experimental.data Sequence of bytes Data 1.8.0 to 1.8.6
tcp.options.md5 Boolean TCP MD5 Option 1.0.0 to 1.8.6
tcp.options.mood Boolean TCP Mood Option 1.4.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.mood_val Character string TCP Mood Option Value 1.4.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.mptcp.addrid Unsigned integer, 1 byte Multipath TCP Address ID 1.8.0 to 1.8.6
tcp.options.mptcp.backup.flag Unsigned integer, 1 byte Backup flag 1.8.0 to 1.8.6
tcp.options.mptcp.checksum Unsigned integer, 2 bytes Multipath TCP Checksum 1.8.0 to 1.8.6
tcp.options.mptcp.checksumreq.flags Unsigned integer, 1 byte Checksum required 1.8.0 to 1.8.6
tcp.options.mptcp.dataack Unsigned integer, 8 bytes Multipath TCP Data ACK 1.8.0 to 1.8.6
tcp.options.mptcp.dataack8.flag Unsigned integer, 1 byte Data ACK is 8 octets 1.8.0 to 1.8.6
tcp.options.mptcp.dataackpresent.flag Unsigned integer, 1 byte Data ACK is present 1.8.0 to 1.8.6
tcp.options.mptcp.datafin.flag Unsigned integer, 1 byte DATA_FIN 1.8.0 to 1.8.6
tcp.options.mptcp.datalvllen Unsigned integer, 2 bytes Multipath TCP Data-level Length 1.8.0 to 1.8.6
tcp.options.mptcp.dataseqno Unsigned integer, 8 bytes Multipath TCP Data Sequence Number 1.8.0 to 1.8.6
tcp.options.mptcp.dseqn8.flag Unsigned integer, 1 byte Data Sequence Number is 8 octets 1.8.0 to 1.8.6
tcp.options.mptcp.dseqnpresent.flag Unsigned integer, 1 byte Data Sequence Number, Subflow Sequence Number, Data-level Length, Checksum present 1.8.0 to 1.8.6
tcp.options.mptcp.flags Unsigned integer, 1 byte Multipath TCP flags 1.8.0 to 1.8.6
tcp.options.mptcp.ipv4 IPv4 address Multipath TCP Address 1.8.0 to 1.8.6
tcp.options.mptcp.ipv6 IPv6 address Multipath TCP Address 1.8.0 to 1.8.6
tcp.options.mptcp.ipver Unsigned integer, 1 byte Multipath TCP IPVer 1.8.0 to 1.8.6
tcp.options.mptcp.port Unsigned integer, 2 bytes Multipath TCP Port 1.8.0 to 1.8.6
tcp.options.mptcp.recvkey Unsigned integer, 8 bytes Multipath TCP Receiver's Key 1.8.0 to 1.8.6
tcp.options.mptcp.recvtok Unsigned integer, 4 bytes Multipath TCP Receiver's Token 1.8.0 to 1.8.6
tcp.options.mptcp.sendkey Unsigned integer, 8 bytes Multipath TCP Sender's Key 1.8.0 to 1.8.6
tcp.options.mptcp.sendmac Unsigned integer, 4 bytes Multipath TCP Sender's MAC 1.8.0 to 1.8.6
tcp.options.mptcp.sendrand Unsigned integer, 4 bytes Multipath TCP Sender's Random Number 1.8.0 to 1.8.6
tcp.options.mptcp.sendtruncmac Unsigned integer, 8 bytes Multipath TCP Sender's Truncated MAC 1.8.0 to 1.8.6
tcp.options.mptcp.sha1.flag Unsigned integer, 1 byte Use HMAC-SHA1 1.8.0 to 1.8.6
tcp.options.mptcp.subflowseqno Unsigned integer, 4 bytes Multipath TCP Subflow Sequence Number 1.8.0 to 1.8.6
tcp.options.mptcp.subtype Unsigned integer, 1 byte Multipath TCP subtype 1.8.0 to 1.8.6
tcp.options.mptcp.version Unsigned integer, 1 byte Multipath TCP version 1.8.0 to 1.8.6
tcp.options.mss Label TCP MSS Option 1.0.0 to 1.8.6
tcp.options.mss_val Unsigned integer, 2 bytes MSS Value 1.0.0 to 1.8.6
tcp.options.qs Boolean TCP QS Option 1.0.0 to 1.8.6
tcp.options.rvbd.probe Boolean Riverbed Probe 1.6.0 to 1.8.6
tcp.options.rvbd.probe.appli_ver Unsigned integer, 2 bytes Application Version 1.6.0 to 1.8.6
tcp.options.rvbd.probe.client.ip IPv4 address Client IP 1.6.0 to 1.8.6
tcp.options.rvbd.probe.flags Unsigned integer, 1 byte Probe Flags 1.6.0 to 1.8.6
tcp.options.rvbd.probe.flags.last Boolean Last Notify 1.6.0 to 1.8.6
tcp.options.rvbd.probe.flags.notcfe Boolean Not CFE 1.6.0 to 1.8.6
tcp.options.rvbd.probe.flags.probe Boolean Disable Probe Cache on CSH 1.6.0 to 1.8.6
tcp.options.rvbd.probe.flags.server Boolean SSH outer to server established 1.6.0 to 1.8.6
tcp.options.rvbd.probe.flags.ssl Boolean SSL Enabled 1.6.0 to 1.8.6
tcp.options.rvbd.probe.len Unsigned integer, 1 byte Length 1.6.0 to 1.8.6
tcp.options.rvbd.probe.prober IPv4 address CSH IP 1.6.0 to 1.8.6
tcp.options.rvbd.probe.proxy.ip IPv4 address SSH IP 1.6.0 to 1.8.6
tcp.options.rvbd.probe.proxy.port Unsigned integer, 2 bytes SSH Port 1.6.0 to 1.8.6
tcp.options.rvbd.probe.storeid Unsigned integer, 4 bytes CFE Store ID 1.6.0 to 1.8.6
tcp.options.rvbd.probe.type1 Unsigned integer, 1 byte Type 1.6.0 to 1.8.6
tcp.options.rvbd.probe.type2 Unsigned integer, 1 byte Type 1.6.0 to 1.8.6
tcp.options.rvbd.probe.version Unsigned integer, 1 byte Version 1.6.0 to 1.8.6
tcp.options.rvbd.probe.version_raw Unsigned integer, 1 byte Version 1.6.0 to 1.8.6
tcp.options.rvbd.trpy Boolean Riverbed Transparency 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.client.port Unsigned integer, 2 bytes Out of band connection Client Port 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.dst.ip IPv4 address Dst SH IP Addr 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.dst.port Unsigned integer, 2 bytes Dst SH Inner Port 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.flags Unsigned integer, 2 bytes Transparency Options 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.flags.chksum Boolean Reserved 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.flags.fw_rst Boolean Enable Transparency FW feature on All FWs 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.flags.fw_rst_inner Boolean Enable Inner FW feature on All FWs 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.flags.fw_rst_probe Boolean Enable FW traversal feature 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.flags.mode Boolean Transparency Mode 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.flags.oob Boolean Out of band connection 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.src.ip IPv4 address Src SH IP Addr 1.6.0 to 1.8.6
tcp.options.rvbd.trpy.src.port Unsigned integer, 2 bytes Src SH Inner Port 1.6.0 to 1.8.6
tcp.options.sack Boolean TCP SACK Option 1.0.0 to 1.8.6
tcp.options.sack_le Unsigned integer, 4 bytes TCP SACK Left Edge 1.0.0 to 1.8.6
tcp.options.sack_perm Boolean TCP SACK Permitted Option 1.0.0 to 1.8.6
tcp.options.sack_re Unsigned integer, 4 bytes TCP SACK Right Edge 1.0.0 to 1.8.6
tcp.options.scps Boolean TCP SCPS Capabilities Option 1.2.0 to 1.8.6
tcp.options.scps.binding Unsigned integer, 1 byte Connection ID 1.2.0 to 1.8.6
tcp.options.scps.binding.id Unsigned integer, 1 byte Binding Space (Community) ID 1.4.9 to 1.4.15, 1.6.2 to 1.8.6
tcp.options.scps.binding.len Unsigned integer, 1 byte Extended Capability Length 1.4.9 to 1.4.15, 1.6.2 to 1.8.6
tcp.options.scps.vector Unsigned integer, 1 byte TCP SCPS Capabilities Vector 1.2.0 to 1.8.6
tcp.options.scpsflags.bets Boolean Partial Reliability Capable (BETS) 1.2.0 to 1.8.6
tcp.options.scpsflags.compress Boolean Lossless Header Compression (COMP) 1.2.0 to 1.8.6
tcp.options.scpsflags.nlts Boolean Network Layer Timestamp (NLTS) 1.2.0 to 1.8.6
tcp.options.scpsflags.reserved Unsigned integer, 1 byte Reserved 1.4.11 to 1.4.15, 1.6.5 to 1.8.6
tcp.options.scpsflags.reserved1 Boolean Reserved Bit 1 1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.reserved2 Boolean Reserved Bit 2 1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.reserved3 Boolean Reserved Bit 3 1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.snack1 Boolean Short Form SNACK Capable (SNACK1) 1.2.0 to 1.8.6
tcp.options.scpsflags.snack2 Boolean Long Form SNACK Capable (SNACK2) 1.2.0 to 1.8.6
tcp.options.snack Boolean TCP Selective Negative Acknowledgment Option 1.2.0 to 1.8.6
tcp.options.snack.le Unsigned integer, 2 bytes TCP SNACK Left Edge 1.2.0 to 1.8.6
tcp.options.snack.offset Unsigned integer, 2 bytes TCP SNACK Offset 1.2.0 to 1.8.6
tcp.options.snack.re Unsigned integer, 2 bytes TCP SNACK Right Edge 1.2.0 to 1.8.6
tcp.options.snack.size Unsigned integer, 2 bytes TCP SNACK Size 1.2.0 to 1.8.6
tcp.options.time_stamp Boolean TCP Time Stamp Option 1.0.0 to 1.4.15
tcp.options.timestamp.tsecr Unsigned integer, 4 bytes Timestamp echo reply 1.6.0 to 1.8.6
tcp.options.timestamp.tsval Unsigned integer, 4 bytes Timestamp value 1.6.0 to 1.8.6
tcp.options.user_to Boolean TCP User Timeout 1.6.0 to 1.8.6
tcp.options.user_to_granularity Boolean Granularity 1.6.0 to 1.8.6
tcp.options.user_to_val Unsigned integer, 2 bytes User Timeout 1.6.0 to 1.8.6
tcp.options.wscale Boolean TCP Window Scale Option 1.0.0 to 1.4.15
tcp.options.wscale.multiplier Unsigned integer, 1 byte Multiplier 1.6.0 to 1.8.6
tcp.options.wscale.shift Unsigned integer, 1 byte Shift count 1.6.0 to 1.8.6
tcp.options.wscale_val Unsigned integer, 1 byte TCP Windows Scale Option Value 1.0.0 to 1.4.15
tcp.pdu.last_frame Frame number Last frame of this PDU 1.0.0 to 1.8.6
tcp.pdu.size Unsigned integer, 4 bytes PDU Size 1.0.0 to 1.8.6
tcp.pdu.time Time offset Time until the last segment of this PDU 1.0.0 to 1.8.6
tcp.port Unsigned integer, 2 bytes Source or Destination Port 1.0.0 to 1.8.6
tcp.proc.dstcmd Character string Destination process name 1.2.0 to 1.8.6
tcp.proc.dstpid Unsigned integer, 4 bytes Destination process ID 1.2.0 to 1.8.6
tcp.proc.dstuid Unsigned integer, 4 bytes Destination process user ID 1.2.0 to 1.8.6
tcp.proc.dstuname Character string Destination process user name 1.2.0 to 1.8.6
tcp.proc.srccmd Character string Source process name 1.2.0 to 1.8.6
tcp.proc.srcpid Unsigned integer, 4 bytes Source process ID 1.2.0 to 1.8.6
tcp.proc.srcuid Unsigned integer, 4 bytes Source process user ID 1.2.0 to 1.8.6
tcp.proc.srcuname Character string Source process user name 1.2.0 to 1.8.6
tcp.reassembled.length Unsigned integer, 4 bytes Reassembled TCP length 1.4.0 to 1.8.6
tcp.reassembled_in Frame number Reassembled PDU in frame 1.0.0 to 1.8.6
tcp.segment Frame number TCP Segment 1.0.0 to 1.8.6
tcp.segment.count Unsigned integer, 4 bytes Segment count 1.6.0 to 1.8.6
tcp.segment.error Frame number Reassembling error 1.0.0 to 1.8.6
tcp.segment.multipletails Boolean Multiple tail segments found 1.0.0 to 1.8.6
tcp.segment.overlap Boolean Segment overlap 1.0.0 to 1.8.6
tcp.segment.overlap.conflict Boolean Conflicting data in segment overlap 1.0.0 to 1.8.6
tcp.segment.toolongfragment Boolean Segment too long 1.0.0 to 1.8.6
tcp.segments Label Reassembled TCP Segments 1.0.0 to 1.8.6
tcp.seq Unsigned integer, 4 bytes Sequence number 1.0.0 to 1.8.6
tcp.srcport Unsigned integer, 2 bytes Source Port 1.0.0 to 1.8.6
tcp.stream Unsigned integer, 4 bytes Stream index 1.2.0 to 1.8.6
tcp.time_delta Time offset Time since previous frame in this TCP stream 1.0.0 to 1.8.6
tcp.time_relative Time offset Time since first frame in this TCP stream 1.0.0 to 1.8.6
tcp.urgent_pointer Unsigned integer, 2 bytes Urgent pointer 1.0.0 to 1.8.6
tcp.window_size Unsigned integer, 4 bytes Calculated window size 1.0.0 to 1.8.6
tcp.window_size_scalefactor Signed integer, 4 bytes Window size scaling factor 1.6.0 to 1.8.6
tcp.window_size_value Unsigned integer, 2 bytes Window size value 1.6.0 to 1.8.6

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation