Join us 4-8 November in Vienna for SharkFest'24 EUROPE, the official Wireshark Developer and User Conference
Wireshark logo

Display Filter Reference: Transmission Control Protocol

Protocol field name: tcp

Versions: 1.0.0 to 4.4.1

Back to Display Filter Reference

Field name Description Type Versions
mptcp.analysis.echoed_key_mismatchExpert InfoLabel2.0.0 to 2.0.16
mptcp.analysis.missing_algorithmExpert InfoLabel2.0.0 to 2.0.16
mptcp.analysis.unexpected_idsnExpert InfoLabel2.0.0 to 2.0.16
mptcp.analysis.unsupported_algorithmExpert InfoLabel2.0.0 to 2.0.16
mptcp.connection.echoed_key_mismatchThe echoed key in the ACK of the MPTCP handshake does not match the key of the SYN/ACKLabel2.2.0 to 4.4.1
mptcp.connection.missing_algorithmNo crypto algorithm specifiedLabel2.2.0 to 4.4.1
mptcp.connection.unsupported_algorithmUnsupported algorithmLabel2.2.0 to 4.4.1
mptcp.dss.infinite_mappingFallback to infinite mappingLabel2.2.0 to 4.4.1
mptcp.dss.missing_mappingNo mapping availableLabel2.2.0 to 4.4.1
tcp.ackAcknowledgment NumberUnsigned integer (32 bits)1.0.0 to 4.4.1
tcp.ack.nonzeroThe acknowledgment number field is nonzero while the ACK flag is not setLabel1.12.0 to 4.4.1
tcp.ack_rawAcknowledgment number (raw)Unsigned integer (32 bits)3.2.0 to 4.4.1
tcp.analysisSEQ/ACK analysisLabel1.8.0 to 4.4.1
tcp.analysis.ack_lost_segmentACKed segment that wasn't captured (common at capture start)Label1.0.0 to 4.4.1
tcp.analysis.ack_rttThe RTT to ACK the segment wasTime offset1.0.0 to 4.4.1
tcp.analysis.acks_frameThis is an ACK to the segment in frameFrame number1.0.0 to 4.4.1
tcp.analysis.bytes_in_flightBytes in flightUnsigned integer (32 bits)1.2.0 to 4.4.1
tcp.analysis.duplicate_ackDuplicate ACKLabel1.0.0 to 4.4.1
tcp.analysis.duplicate_ack_frameDuplicate to the ACK in frameFrame number1.0.0 to 4.4.1
tcp.analysis.duplicate_ack_numDuplicate ACK #Unsigned integer (32 bits)1.0.0 to 4.4.1
tcp.analysis.fast_retransmissionThis frame is a (suspected) fast retransmissionLabel1.0.0 to 4.4.1
tcp.analysis.flagsTCP Analysis FlagsLabel1.0.0 to 4.4.1
tcp.analysis.initial_rttiRTTTime offset1.12.0 to 4.4.1
tcp.analysis.keep_aliveTCP keep-alive segmentLabel1.0.0 to 4.4.1
tcp.analysis.keep_alive_ackACK to a TCP keep-alive segmentLabel1.0.0 to 4.4.1
tcp.analysis.lost_segmentPrevious segment(s) not captured (common at capture start)Label1.0.0 to 4.4.1
tcp.analysis.out_of_orderThis frame is a (suspected) out-of-order segmentLabel1.0.0 to 4.4.1
tcp.analysis.partial_ackPartial Acknowledgement of a segmentLabel4.4.0 to 4.4.1
tcp.analysis.push_bytes_sentBytes sent since last PSH flagUnsigned integer (32 bits)2.2.0 to 4.4.1
tcp.analysis.retransmissionThis frame is a (suspected) retransmissionLabel1.0.0 to 4.4.1
tcp.analysis.reused_portsA new tcp session is started with the same ports as an earlier session in this traceLabel1.0.0 to 4.4.1
tcp.analysis.rtoThe RTO for this segment wasTime offset1.0.0 to 4.4.1
tcp.analysis.rto_frameRTO based on delta from frameFrame number1.0.0 to 4.4.1
tcp.analysis.spurious_retransmissionThis frame is a (suspected) spurious retransmissionLabel1.12.0 to 4.4.1
tcp.analysis.tfo_ackTCP SYN-ACK accepting TFO dataLabel3.4.0 to 4.4.1
tcp.analysis.tfo_ignoredTCP SYN-ACK ignoring TFO dataLabel3.4.0 to 4.4.1
tcp.analysis.tfo_synTCP SYN with TFO CookieLabel2.0.0 to 4.4.1
tcp.analysis.window_fullTCP window specified by the receiver is now completely fullLabel1.0.0 to 4.4.1
tcp.analysis.window_updateTCP window updateLabel1.0.0 to 4.4.1
tcp.analysis.zero_windowTCP Zero Window segmentLabel1.0.0 to 4.4.1
tcp.analysis.zero_window_probeTCP Zero Window ProbeLabel1.0.0 to 4.4.1
tcp.analysis.zero_window_probe_ackACK to a TCP Zero Window ProbeLabel1.0.0 to 4.4.1
tcp.bogus_header_lengthBogus TCP Header lengthLabel3.0.0 to 4.4.1
tcp.checksumChecksumUnsigned integer (16 bits)1.0.0 to 4.4.1
tcp.checksum.ffffTCP Checksum 0xffff instead of 0x0000 (see RFC 1624)Label1.12.0 to 4.4.1
tcp.checksum.partialPartial (pseudo header) checksum (likely caused by "TCP checksum offload")Label4.2.0 to 4.4.1
tcp.checksum.statusChecksum StatusUnsigned integer (8 bits)2.2.0 to 4.4.1
tcp.checksum_badBad ChecksumBoolean1.0.0 to 2.0.16
tcp.checksum_bad.expertBad checksumLabel1.12.0 to 4.4.1
tcp.checksum_calculatedCalculated ChecksumUnsigned integer (16 bits)1.12.0 to 4.4.1
tcp.checksum_goodGood ChecksumBoolean1.0.0 to 2.0.16
tcp.completenessConversation completenessUnsigned integer (8 bits)3.6.0 to 4.4.1
tcp.completeness.ackACKBoolean4.2.0 to 4.4.1
tcp.completeness.dataDataBoolean4.2.0 to 4.4.1
tcp.completeness.finFINBoolean4.2.0 to 4.4.1
tcp.completeness.rstRSTBoolean4.2.0 to 4.4.1
tcp.completeness.strCompleteness FlagsCharacter string4.2.0 to 4.4.1
tcp.completeness.synSYNBoolean4.2.0 to 4.4.1
tcp.completeness.syn-ackSYN-ACKBoolean4.2.0 to 4.4.1
tcp.connection.finConnection finish (FIN)Label1.12.0 to 4.4.1
tcp.connection.fin_activeThis frame initiates the connection closingLabel3.6.0 to 4.4.1
tcp.connection.fin_passiveThis frame undergoes the connection closingLabel3.6.0 to 4.4.1
tcp.connection.rstConnection reset (RST)Label1.12.0 to 4.4.1
tcp.connection.sackConnection establish acknowledge (SYN+ACK)Label1.12.0 to 3.2.18
tcp.connection.synConnection establish request (SYN)Label1.12.0 to 4.4.1
tcp.connection.synackConnection establish acknowledge (SYN+ACK)Label3.4.0 to 4.4.1
tcp.continuation_toThis is a continuation to the PDU in frameFrame number1.0.0 to 4.4.1
tcp.dataTCP segment dataByte sequence1.4.5 to 1.8.15
tcp.dstportDestination PortUnsigned integer (16 bits)1.0.0 to 4.4.1
tcp.fin_retransmissionRetransmission of FIN from frameFrame number2.0.0 to 4.4.1
tcp.flagsFlagsUnsigned integer (16 bits)1.0.0 to 4.4.1
tcp.flags.aceACEUnsigned integer (8 bits)4.0.0 to 4.4.1
tcp.flags.ackAcknowledgmentBoolean1.0.0 to 4.4.1
tcp.flags.aeAccurate ECNBoolean4.0.0 to 4.4.1
tcp.flags.cwrCongestion Window ReducedBoolean1.0.0 to 4.4.1
tcp.flags.eceECN-EchoBoolean4.0.0 to 4.4.1
tcp.flags.ecnECN-EchoBoolean1.0.0 to 3.6.24
tcp.flags.finFinBoolean1.0.0 to 4.4.1
tcp.flags.nsNonceBoolean1.4.1 to 3.6.24
tcp.flags.pushPushBoolean1.0.0 to 4.4.1
tcp.flags.resReservedBoolean1.4.1 to 4.4.1
tcp.flags.resetResetBoolean1.0.0 to 4.4.1
tcp.flags.strTCP FlagsCharacter string2.0.0 to 4.4.1
tcp.flags.synSynBoolean1.0.0 to 4.4.1
tcp.flags.urgUrgentBoolean1.0.0 to 4.4.1
tcp.hdr_lenHeader LengthUnsigned integer (8 bits)1.0.0 to 4.4.1
tcp.lenTCP Segment LenUnsigned integer (32 bits)1.0.0 to 4.4.1
tcp.non_zero_bytes_after_eolNon zero bytes in option space after EOL optionLabel4.0.0 to 4.4.1
tcp.nop4 NOP in a row - a router may have removed some optionsLabel2.4.0 to 4.4.1
tcp.nstrace.rst.window_error_codeNetScaler TCP Reset Window Error CodeCharacter string4.4.0 to 4.4.1
tcp.nxtseqNext Sequence NumberUnsigned integer (32 bits)1.0.0 to 4.4.1
tcp.option.len.invalidInvalid length for optionLabel1.12.0 to 4.4.1
tcp.option_kindKindUnsigned integer (8 bits)1.6.0 to 4.4.1
tcp.option_lenLengthUnsigned integer (8 bits)1.6.0 to 4.4.1
tcp.optionsTCP OptionsByte sequence1.0.0 to 4.4.1
tcp.options.acc_ecn.ecebAccurate ECN Echo CE Byte CounterUnsigned integer (24 bits)4.0.0 to 4.4.1
tcp.options.acc_ecn.ee0bAccurate ECN Echo ECT(0) Byte CounterUnsigned integer (24 bits)4.0.0 to 4.4.1
tcp.options.acc_ecn.ee1bAccurate ECN Echo ECT(1) Byte CounterUnsigned integer (24 bits)4.0.0 to 4.4.1
tcp.options.ao.keyidAO KeyIDUnsigned integer (8 bits)3.6.0 to 4.4.1
tcp.options.ao.macAO MACByte sequence3.6.0 to 4.4.1
tcp.options.ao.rnextkeyidAO RNextKeyIDUnsigned integer (8 bits)3.6.0 to 4.4.1
tcp.options.ccTCP CC OptionBoolean1.0.0 to 2.2.17
tcp.options.cc_valueTCP CC OptionUnsigned integer (32 bits)2.4.0 to 4.4.1
tcp.options.ccechoTCP CC Echo OptionBoolean1.0.0 to 1.8.15
tcp.options.ccnewTCP CC New OptionBoolean1.0.0 to 1.8.15
tcp.options.echoTCP Echo OptionBoolean1.0.0 to 2.2.17
tcp.options.echo_replyTCP Echo Reply OptionBoolean1.0.0 to 1.8.15
tcp.options.echo_valueTCP Echo OptionUnsigned integer (32 bits)2.4.0 to 4.4.1
tcp.options.experimentalTCP Option - ExperimentalByte sequence1.8.0 to 2.2.17
tcp.options.experimental.dataDataByte sequence1.8.0 to 4.4.1
tcp.options.experimental.exidExperiment IdentifierUnsigned integer (16 bits)4.0.0 to 4.4.1
tcp.options.experimental.magic_numberMagic NumberUnsigned integer (16 bits)1.10.0 to 3.6.24
tcp.options.md5TCP MD5 OptionBoolean1.0.0 to 1.8.15
tcp.options.md5.digestMD5 digestByte sequence2.4.0 to 4.4.1
tcp.options.moodTCP Mood OptionBoolean1.4.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.mood_valTCP Mood Option ValueCharacter string1.4.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.mptcp.addaddrtrunchmacTruncated HMACUnsigned integer (64 bits)2.2.0 to 4.4.1
tcp.options.mptcp.addridAddress IDUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.backup.flagBackup flagUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.checksumChecksumUnsigned integer (16 bits)1.8.0 to 4.4.1
tcp.options.mptcp.checksumreq.flagsChecksum requiredUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.dataackMultipath TCP Data ACKUnsigned integer (64 bits)1.8.0 to 1.12.13
tcp.options.mptcp.dataack8.flagData ACK is 8 octetsUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.dataackpresent.flagData ACK is presentUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.datafin.flagDATA_FINUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.datalvllenData-level LengthUnsigned integer (16 bits)1.8.0 to 4.4.1
tcp.options.mptcp.dataseqnoMultipath TCP Data Sequence NumberUnsigned integer (64 bits)1.8.0 to 1.12.13
tcp.options.mptcp.dseqn8.flagData Sequence Number is 8 octetsUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.dseqnpresent.flagData Sequence Number, Subflow Sequence Number, Data-level Length, Checksum presentUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.echoEchoUnsigned integer (8 bits)3.4.0 to 4.4.1
tcp.options.mptcp.extensibility.flagExtensibilityUnsigned integer (8 bits)2.0.0 to 4.4.1
tcp.options.mptcp.flag_T.flagTransientBoolean3.6.0 to 4.4.1
tcp.options.mptcp.flag_U.flagFlag UBoolean3.6.0 to 4.4.1
tcp.options.mptcp.flag_V.flagFlag VBoolean3.6.0 to 4.4.1
tcp.options.mptcp.flag_W.flagFlag WBoolean3.6.0 to 4.4.1
tcp.options.mptcp.flagsMultipath TCP flagsUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.ipv4Advertised IPv4 AddressIPv4 address1.8.0 to 4.4.1
tcp.options.mptcp.ipv6Advertised IPv6 AddressIPv6 address1.8.0 to 4.4.1
tcp.options.mptcp.ipverIP versionUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.nomoresubflows.flagDo not attempt to establish new subflows to this address and portUnsigned integer (8 bits)3.6.0 to 4.4.1
tcp.options.mptcp.portAdvertised portUnsigned integer (16 bits)1.8.0 to 4.4.1
tcp.options.mptcp.rawdataackOriginal MPTCP Data ACKUnsigned integer (64 bits)2.0.0 to 4.4.1
tcp.options.mptcp.rawdataseqnoData Sequence NumberUnsigned integer (64 bits)2.0.0 to 4.4.1
tcp.options.mptcp.recvkeyReceiver's KeyUnsigned integer (64 bits)1.8.0 to 4.4.1
tcp.options.mptcp.recvtokReceiver's TokenUnsigned integer (32 bits)1.8.0 to 4.4.1
tcp.options.mptcp.reservedReservedUnsigned integer (16 bits)2.0.0 to 4.4.1
tcp.options.mptcp.reserved.flagReservedUnsigned integer (8 bits)2.0.0 to 4.4.1
tcp.options.mptcp.rst_reasonTCPRST ReasonUnsigned integer (8 bits)3.6.0 to 4.4.1
tcp.options.mptcp.sendhmacSender's HMACByte sequence2.0.0 to 4.4.1
tcp.options.mptcp.sendkeySender's KeyUnsigned integer (64 bits)1.8.0 to 4.4.1
tcp.options.mptcp.sendmacMultipath TCP Sender's MACUnsigned integer (32 bits)1.8.0 to 1.12.13
tcp.options.mptcp.sendrandSender's Random NumberUnsigned integer (32 bits)1.8.0 to 4.4.1
tcp.options.mptcp.sendtrunchmacSender's Truncated HMACUnsigned integer (64 bits)2.0.0 to 4.4.1
tcp.options.mptcp.sendtruncmacMultipath TCP Sender's Truncated MACUnsigned integer (64 bits)1.8.0 to 1.12.13
tcp.options.mptcp.sha1.flagUse HMAC-SHA1Unsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.sha256.flagUse HMAC-SHA256Unsigned integer (8 bits)3.2.0 to 4.4.1
tcp.options.mptcp.subflowseqnoSubflow Sequence NumberUnsigned integer (32 bits)1.8.0 to 4.4.1
tcp.options.mptcp.subtypeMultipath TCP subtypeUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mptcp.versionMultipath TCP versionUnsigned integer (8 bits)1.8.0 to 4.4.1
tcp.options.mssTCP MSS OptionLabel1.0.0 to 2.2.17
tcp.options.mss.absentThe SYN packet does not contain a MSS optionLabel3.2.0 to 4.4.1
tcp.options.mss.presentThe non-SYN packet does contain a MSS optionLabel3.2.0 to 4.4.1
tcp.options.mss_valMSS ValueUnsigned integer (16 bits)1.0.0 to 4.4.1
tcp.options.qsTCP QS OptionBoolean1.0.0 to 2.2.17
tcp.options.qs.rateQS RateUnsigned integer (8 bits)2.4.0 to 4.4.1
tcp.options.qs.ttl_diffQS RateUnsigned integer (8 bits)2.4.0 to 4.4.1
tcp.options.rvbd.probeRiverbed ProbeBoolean1.6.0 to 2.2.17
tcp.options.rvbd.probe.appli_verApplication VersionUnsigned integer (16 bits)1.6.0 to 4.4.1
tcp.options.rvbd.probe.client.ipClient IPIPv4 address1.6.0 to 4.4.1
tcp.options.rvbd.probe.flagsProbe FlagsUnsigned integer (8 bits)1.6.0 to 4.4.1
tcp.options.rvbd.probe.flags.lastLast NotifyBoolean1.6.0 to 4.4.1
tcp.options.rvbd.probe.flags.notcfeNot CFEBoolean1.6.0 to 4.4.1
tcp.options.rvbd.probe.flags.probeDisable Probe Cache on CSHBoolean1.6.0 to 4.4.1
tcp.options.rvbd.probe.flags.serverSSH outer to server establishedBoolean1.6.0 to 4.4.1
tcp.options.rvbd.probe.flags.sslSSL EnabledBoolean1.6.0 to 4.4.1
tcp.options.rvbd.probe.lenLengthUnsigned integer (8 bits)1.6.0 to 2.4.16
tcp.options.rvbd.probe.proberCSH IPIPv4 address1.6.0 to 4.4.1
tcp.options.rvbd.probe.proxy.ipSSH IPIPv4 address1.6.0 to 4.4.1
tcp.options.rvbd.probe.proxy.portSSH PortUnsigned integer (16 bits)1.6.0 to 4.4.1
tcp.options.rvbd.probe.reservedReservedUnsigned integer (8 bits)2.0.0 to 4.4.1
tcp.options.rvbd.probe.storeidCFE Store IDUnsigned integer (32 bits)1.6.0 to 4.4.1
tcp.options.rvbd.probe.type1TypeUnsigned integer (8 bits)1.6.0 to 4.4.1
tcp.options.rvbd.probe.type2TypeUnsigned integer (8 bits)1.6.0 to 4.4.1
tcp.options.rvbd.probe.versionVersionUnsigned integer (8 bits)1.6.0 to 4.4.1
tcp.options.rvbd.probe.version_rawVersionUnsigned integer (8 bits)1.6.0 to 4.4.1
tcp.options.rvbd.trpyRiverbed TransparencyBoolean1.6.0 to 2.2.17
tcp.options.rvbd.trpy.client.portOut of band connection Client PortUnsigned integer (16 bits)1.6.0 to 4.4.1
tcp.options.rvbd.trpy.dst.ipDst SH IP AddrIPv4 address1.6.0 to 4.4.1
tcp.options.rvbd.trpy.dst.portDst SH Inner PortUnsigned integer (16 bits)1.6.0 to 4.4.1
tcp.options.rvbd.trpy.flagsTransparency OptionsUnsigned integer (16 bits)1.6.0 to 4.4.1
tcp.options.rvbd.trpy.flags.chksumReservedBoolean1.6.0 to 4.4.1
tcp.options.rvbd.trpy.flags.fw_rstEnable Transparency FW feature on All FWsBoolean1.6.0 to 4.4.1
tcp.options.rvbd.trpy.flags.fw_rst_innerEnable Inner FW feature on All FWsBoolean1.6.0 to 4.4.1
tcp.options.rvbd.trpy.flags.fw_rst_probeEnable FW traversal featureBoolean1.6.0 to 4.4.1
tcp.options.rvbd.trpy.flags.modeTransparency ModeBoolean1.6.0 to 4.4.1
tcp.options.rvbd.trpy.flags.oobOut of band connectionBoolean1.6.0 to 4.4.1
tcp.options.rvbd.trpy.src.ipSrc SH IP AddrIPv4 address1.6.0 to 4.4.1
tcp.options.rvbd.trpy.src.portSrc SH Inner PortUnsigned integer (16 bits)1.6.0 to 4.4.1
tcp.options.sackTCP SACK OptionBoolean1.0.0 to 2.2.17
tcp.options.sack.countTCP SACK CountUnsigned integer (8 bits)1.10.0 to 4.4.1
tcp.options.sack.dsackD-SACK SequenceLabel3.4.0 to 4.4.1
tcp.options.sack.dsack_leTCP D-SACK Left EdgeUnsigned integer (32 bits)3.4.0 to 4.4.1
tcp.options.sack.dsack_reTCP D-SACK Right EdgeUnsigned integer (32 bits)3.4.0 to 4.4.1
tcp.options.sack_leTCP SACK Left EdgeUnsigned integer (32 bits)1.0.0 to 4.4.1
tcp.options.sack_permTCP SACK Permitted OptionBoolean1.0.0 to 2.2.17
tcp.options.sack_perm.absentThe SYN packet does not contain a SACK PERM optionLabel4.2.0 to 4.4.1
tcp.options.sack_perm.presentThe non-SYN packet does contain a SACK PERM optionLabel4.2.0 to 4.4.1
tcp.options.sack_reTCP SACK Right EdgeUnsigned integer (32 bits)1.0.0 to 4.4.1
tcp.options.scpsTCP SCPS Capabilities OptionBoolean1.2.0 to 2.2.17
tcp.options.scps.bindingConnection IDUnsigned integer (8 bits)1.2.0 to 4.4.1
tcp.options.scps.binding.dataBinding Space DataByte sequence2.0.0 to 4.4.1
tcp.options.scps.binding.idBinding Space (Community) IDUnsigned integer (8 bits)1.4.9 to 1.4.15, 1.6.2 to 4.4.1
tcp.options.scps.binding.lenExtended Capability LengthUnsigned integer (8 bits)1.4.9 to 1.4.15, 1.6.2 to 4.4.1
tcp.options.scps.vectorTCP SCPS Capabilities VectorUnsigned integer (8 bits)1.2.0 to 4.4.1
tcp.options.scpsflags.betsPartial Reliability Capable (BETS)Boolean1.2.0 to 4.4.1
tcp.options.scpsflags.compressLossless Header Compression (COMP)Boolean1.2.0 to 4.4.1
tcp.options.scpsflags.nltsNetwork Layer Timestamp (NLTS)Boolean1.2.0 to 4.4.1
tcp.options.scpsflags.reservedReservedUnsigned integer (8 bits)1.4.11 to 1.4.15, 1.6.5 to 4.4.1
tcp.options.scpsflags.reserved1Reserved Bit 1Boolean1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.reserved2Reserved Bit 2Boolean1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.reserved3Reserved Bit 3Boolean1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.snack1Short Form SNACK Capable (SNACK1)Boolean1.2.0 to 4.4.1
tcp.options.scpsflags.snack2Long Form SNACK Capable (SNACK2)Boolean1.2.0 to 4.4.1
tcp.options.snackTCP Selective Negative Acknowledgment OptionBoolean1.2.0 to 2.2.17
tcp.options.snack.leTCP SNACK Left EdgeUnsigned integer (16 bits)1.2.0 to 4.4.1
tcp.options.snack.offsetTCP SNACK OffsetUnsigned integer (16 bits)1.2.0 to 4.4.1
tcp.options.snack.reTCP SNACK Right EdgeUnsigned integer (16 bits)1.2.0 to 4.4.1
tcp.options.snack.sequenceSNACK SequenceLabel1.12.0 to 4.4.1
tcp.options.snack.sizeTCP SNACK SizeUnsigned integer (16 bits)1.2.0 to 4.4.1
tcp.options.tar.reservedTARR ReservedUnsigned integer (8 bits)4.0.0 to 4.4.1
tcp.options.tarr.rateTARR RateUnsigned integer (8 bits)4.0.0 to 4.4.1
tcp.options.tfoFast Open CookieLabel1.10.0 to 2.2.17
tcp.options.tfo.cookieFast Open CookieByte sequence1.10.0 to 4.4.1
tcp.options.tfo.requestFast Open Cookie RequestLabel1.10.0 to 4.4.1
tcp.options.time_stampTCP Time Stamp OptionBoolean1.0.0 to 1.4.15
tcp.options.timestamp.tsecrTimestamp echo replyUnsigned integer (32 bits)1.6.0 to 4.4.1
tcp.options.timestamp.tsvalTimestamp valueUnsigned integer (32 bits)1.6.0 to 4.4.1
tcp.options.timestamp.tsval.syncookie.ecnSYN Cookie ECNBoolean4.0.0 to 4.4.1
tcp.options.timestamp.tsval.syncookie.sackSYN Cookie SACKBoolean4.0.0 to 4.4.1
tcp.options.timestamp.tsval.syncookie.timestampSYN Cookie TimestampUnsigned integer (32 bits)4.0.0 to 4.4.1
tcp.options.timestamp.tsval.syncookie.wscaleSYN Cookie WScaleUnsigned integer (8 bits)4.0.0 to 4.4.1
tcp.options.typeTypeUnsigned integer (8 bits)1.10.1 to 2.2.17
tcp.options.type.classClassUnsigned integer (8 bits)1.10.1 to 2.2.17
tcp.options.type.copyCopy on fragmentationBoolean1.10.1 to 2.2.17
tcp.options.type.numberNumberUnsigned integer (8 bits)1.10.1 to 2.2.17
tcp.options.unknown.payloadPayloadByte sequence2.6.0 to 4.4.1
tcp.options.user_toTCP User TimeoutBoolean1.6.0 to 2.2.17
tcp.options.user_to_granularityGranularityBoolean1.6.0 to 4.4.1
tcp.options.user_to_valUser TimeoutUnsigned integer (16 bits)1.6.0 to 4.4.1
tcp.options.wscaleTCP Window Scale OptionBoolean1.0.0 to 1.4.15
tcp.options.wscale.multiplierMultiplierUnsigned integer (16 bits)1.6.0 to 4.4.1
tcp.options.wscale.shiftShift countUnsigned integer (8 bits)1.6.0 to 4.4.1
tcp.options.wscale.shift.invalidWindow scale shift exceeds 14Label2.0.0 to 4.4.1
tcp.options.wscale_valTCP Windows Scale Option ValueUnsigned integer (8 bits)1.0.0 to 1.4.15
tcp.payloadTCP payloadByte sequence2.4.0 to 4.4.1
tcp.pdu.last_frameLast frame of this PDUFrame number1.0.0 to 4.4.1
tcp.pdu.sizePDU SizeUnsigned integer (32 bits)1.0.0 to 4.4.1
tcp.pdu.timeTime until the last segment of this PDUTime offset1.0.0 to 4.4.1
tcp.portSource or Destination PortUnsigned integer (16 bits)1.0.0 to 4.4.1
tcp.proc.dstcmdDestination process nameCharacter string1.2.0 to 4.4.1
tcp.proc.dstpidDestination process IDUnsigned integer (32 bits)1.2.0 to 4.4.1
tcp.proc.dstuidDestination process user IDUnsigned integer (32 bits)1.2.0 to 4.4.1
tcp.proc.dstunameDestination process user nameCharacter string1.2.0 to 4.4.1
tcp.proc.srccmdSource process nameCharacter string1.2.0 to 4.4.1
tcp.proc.srcpidSource process IDUnsigned integer (32 bits)1.2.0 to 4.4.1
tcp.proc.srcuidSource process user IDUnsigned integer (32 bits)1.2.0 to 4.4.1
tcp.proc.srcunameSource process user nameCharacter string1.2.0 to 4.4.1
tcp.reassembled.dataReassembled TCP DataByte sequence1.10.0 to 4.4.1
tcp.reassembled.lengthReassembled TCP lengthUnsigned integer (32 bits)1.4.0 to 4.4.1
tcp.reassembled_inReassembled PDU in frameFrame number1.0.0 to 4.4.1
tcp.reset_causeReset causeCharacter string2.0.0 to 4.4.1
tcp.segmentTCP SegmentFrame number1.0.0 to 4.4.1
tcp.segment.countSegment countUnsigned integer (32 bits)1.6.0 to 4.4.1
tcp.segment.errorReassembling errorFrame number1.0.0 to 4.4.1
tcp.segment.multipletailsMultiple tail segments foundBoolean1.0.0 to 4.4.1
tcp.segment.overlapSegment overlapBoolean1.0.0 to 4.4.1
tcp.segment.overlap.conflictConflicting data in segment overlapBoolean1.0.0 to 4.4.1
tcp.segment.toolongfragmentSegment too longBoolean1.0.0 to 4.4.1
tcp.segment_dataTCP segment dataByte sequence1.10.0 to 4.4.1
tcp.segmentsReassembled TCP SegmentsLabel1.0.0 to 4.4.1
tcp.seqSequence NumberUnsigned integer (32 bits)1.0.0 to 4.4.1
tcp.seq_rawSequence Number (raw)Unsigned integer (32 bits)3.2.0 to 4.4.1
tcp.short_segmentShort segmentLabel1.12.0 to 4.4.1
tcp.srcportSource PortUnsigned integer (16 bits)1.0.0 to 4.4.1
tcp.streamStream indexUnsigned integer (32 bits)1.2.0 to 4.4.1
tcp.stream.pnumStream Packet NumberUnsigned integer (32 bits)4.4.0 to 4.4.1
tcp.suboption_malformedsuboption would go past end of optionLabel2.0.0 to 4.4.1
tcp.syncookie.hashSYN Cookie hashUnsigned integer (24 bits)4.0.0 to 4.4.1
tcp.syncookie.mssSYN Cookie Maximum Segment SizeUnsigned integer (8 bits)4.0.0 to 4.4.1
tcp.syncookie.timeSYN Cookie TimeUnsigned integer (8 bits)4.0.0 to 4.4.1
tcp.time_deltaTime since previous frame in this TCP streamTime offset1.0.0 to 4.4.1
tcp.time_relativeTime since first frame in this TCP streamTime offset1.0.0 to 4.4.1
tcp.urgent_pointerUrgent PointerUnsigned integer (16 bits)1.0.0 to 4.4.1
tcp.urgent_pointer.non_zeroThe urgent pointer field is nonzero while the URG flag is not setLabel1.12.0 to 4.4.1
tcp.window_sizeCalculated window sizeUnsigned integer (32 bits)1.0.0 to 4.4.1
tcp.window_size_scalefactorWindow size scaling factorSigned integer (32 bits)1.6.0 to 4.4.1
tcp.window_size_valueWindowUnsigned integer (16 bits)1.6.0 to 4.4.1