Display Filter Reference: Transmission Control Protocol
Protocol field name: tcp
Versions: 0.99.0 to 1.0.4
Back to Display Filter Reference
| Field name | Type | Description | Versions |
|---|---|---|---|
| tcp.ack | Unsigned 32-bit integer | Acknowledgement number | 0.99.0 to 1.0.4 |
| tcp.analysis.ack_lost_segment | None | ACKed Lost Packet | 0.99.0 to 1.0.4 |
| tcp.analysis.ack_rtt | Time duration | The RTT to ACK the segment was | 0.99.0 to 1.0.4 |
| tcp.analysis.acks_frame | Frame number | This is an ACK to the segment in frame | 0.99.0 to 1.0.4 |
| tcp.analysis.duplicate_ack | None | Duplicate ACK | 0.99.0 to 1.0.4 |
| tcp.analysis.duplicate_ack_frame | Frame number | Duplicate to the ACK in frame | 0.99.0 to 1.0.4 |
| tcp.analysis.duplicate_ack_num | Unsigned 32-bit integer | Duplicate ACK # | 0.99.0 to 1.0.4 |
| tcp.analysis.fast_retransmission | None | Fast Retransmission | 0.99.0 to 1.0.4 |
| tcp.analysis.flags | None | TCP Analysis Flags | 0.99.0 to 1.0.4 |
| tcp.analysis.keep_alive | None | Keep Alive | 0.99.0 to 1.0.4 |
| tcp.analysis.keep_alive_ack | None | Keep Alive ACK | 0.99.0 to 1.0.4 |
| tcp.analysis.lost_segment | None | Previous Segment Lost | 0.99.0 to 1.0.4 |
| tcp.analysis.out_of_order | None | Out Of Order | 0.99.0 to 1.0.4 |
| tcp.analysis.retransmission | None | Retransmission | 0.99.0 to 1.0.4 |
| tcp.analysis.reused_ports | None | TCP Port numbers reused | 0.99.8 to 1.0.4 |
| tcp.analysis.rto | Time duration | The RTO for this segment was | 0.99.0 to 1.0.4 |
| tcp.analysis.rto_frame | Frame number | RTO based on delta from frame | 0.99.0 to 1.0.4 |
| tcp.analysis.window_full | None | Window full | 0.99.0 to 1.0.4 |
| tcp.analysis.window_update | None | Window update | 0.99.0 to 1.0.4 |
| tcp.analysis.zero_window | None | Zero Window | 0.99.0 to 1.0.4 |
| tcp.analysis.zero_window_probe | None | Zero Window Probe | 0.99.0 to 1.0.4 |
| tcp.analysis.zero_window_probe_ack | None | Zero Window Probe Ack | 0.99.0 to 1.0.4 |
| tcp.checksum | Unsigned 16-bit integer | Checksum | 0.99.0 to 1.0.4 |
| tcp.checksum_bad | Boolean | Bad Checksum | 0.99.0 to 1.0.4 |
| tcp.checksum_good | Boolean | Good Checksum | 0.99.5 to 1.0.4 |
| tcp.continuation_to | Frame number | This is a continuation to the PDU in frame | 0.99.0 to 1.0.4 |
| tcp.dstport | Unsigned 16-bit integer | Destination Port | 0.99.0 to 1.0.4 |
| tcp.flags | Unsigned 8-bit integer | Flags | 0.99.0 to 1.0.4 |
| tcp.flags.ack | Boolean | Acknowledgment | 0.99.0 to 1.0.4 |
| tcp.flags.cwr | Boolean | Congestion Window Reduced (CWR) | 0.99.0 to 1.0.4 |
| tcp.flags.ecn | Boolean | ECN-Echo | 0.99.0 to 1.0.4 |
| tcp.flags.fin | Boolean | Fin | 0.99.0 to 1.0.4 |
| tcp.flags.push | Boolean | Push | 0.99.0 to 1.0.4 |
| tcp.flags.reset | Boolean | Reset | 0.99.0 to 1.0.4 |
| tcp.flags.syn | Boolean | Syn | 0.99.0 to 1.0.4 |
| tcp.flags.urg | Boolean | Urgent | 0.99.0 to 1.0.4 |
| tcp.hdr_len | Unsigned 8-bit integer | Header Length | 0.99.0 to 1.0.4 |
| tcp.len | Unsigned 32-bit integer | TCP Segment Len | 0.99.0 to 1.0.4 |
| tcp.nxtseq | Unsigned 32-bit integer | Next sequence number | 0.99.0 to 1.0.4 |
| tcp.options | Byte array | TCP Options | 0.99.5 to 1.0.4 |
| tcp.options.cc | Boolean | TCP CC Option | 0.99.0 to 1.0.4 |
| tcp.options.ccecho | Boolean | TCP CC Echo Option | 0.99.0 to 1.0.4 |
| tcp.options.ccnew | Boolean | TCP CC New Option | 0.99.0 to 1.0.4 |
| tcp.options.echo | Boolean | TCP Echo Option | 0.99.0 to 1.0.4 |
| tcp.options.echo_reply | Boolean | TCP Echo Reply Option | 0.99.0 to 1.0.4 |
| tcp.options.md5 | Boolean | TCP MD5 Option | 0.99.0 to 1.0.4 |
| tcp.options.mss | Boolean | TCP MSS Option | 0.99.0 to 1.0.4 |
| tcp.options.mss_val | Unsigned 16-bit integer | TCP MSS Option Value | 0.99.0 to 1.0.4 |
| tcp.options.qs | Boolean | TCP QS Option | 0.99.6 to 1.0.4 |
| tcp.options.sack | Boolean | TCP Sack Option | 0.99.0 to 1.0.4 |
| tcp.options.sack_le | Unsigned 32-bit integer | TCP Sack Left Edge | 0.99.0 to 1.0.4 |
| tcp.options.sack_perm | Boolean | TCP Sack Perm Option | 0.99.0 to 1.0.4 |
| tcp.options.sack_re | Unsigned 32-bit integer | TCP Sack Right Edge | 0.99.0 to 1.0.4 |
| tcp.options.time_stamp | Boolean | TCP Time Stamp Option | 0.99.0 to 1.0.4 |
| tcp.options.wscale | Boolean | TCP Window Scale Option | 0.99.0 to 1.0.4 |
| tcp.options.wscale_val | Unsigned 8-bit integer | TCP Windows Scale Option Value | 0.99.0 to 1.0.4 |
| tcp.pdu.last_frame | Frame number | Last frame of this PDU | 0.99.0 to 1.0.4 |
| tcp.pdu.size | Unsigned 32-bit integer | PDU Size | 0.99.5 to 1.0.4 |
| tcp.pdu.time | Time duration | Time until the last segment of this PDU | 0.99.0 to 1.0.4 |
| tcp.port | Unsigned 16-bit integer | Source or Destination Port | 0.99.0 to 1.0.4 |
| tcp.reassembled_in | Frame number | Reassembled PDU in frame | 0.99.0 to 1.0.4 |
| tcp.segment | Frame number | TCP Segment | 0.99.0 to 1.0.4 |
| tcp.segment.error | Frame number | Reassembling error | 0.99.0 to 1.0.4 |
| tcp.segment.multipletails | Boolean | Multiple tail segments found | 0.99.0 to 1.0.4 |
| tcp.segment.overlap | Boolean | Segment overlap | 0.99.0 to 1.0.4 |
| tcp.segment.overlap.conflict | Boolean | Conflicting data in segment overlap | 0.99.0 to 1.0.4 |
| tcp.segment.toolongfragment | Boolean | Segment too long | 0.99.0 to 1.0.4 |
| tcp.segments | None | Reassembled TCP Segments | 0.99.0 to 1.0.4 |
| tcp.seq | Unsigned 32-bit integer | Sequence number | 0.99.0 to 1.0.4 |
| tcp.srcport | Unsigned 16-bit integer | Source Port | 0.99.0 to 1.0.4 |
| tcp.time_delta | Time duration | Time since previous frame in this TCP stream | 0.99.8 to 1.0.4 |
| tcp.time_relative | Time duration | Time since first frame in this TCP stream | 0.99.8 to 1.0.4 |
| tcp.urgent_pointer | Unsigned 16-bit integer | Urgent pointer | 0.99.0 to 1.0.4 |
| tcp.window_size | Unsigned 32-bit integer | Window size | 0.99.0 to 1.0.4 |
Wireshark and the "fin" logo are registered trademarks of Gerald Combs