Wireshark · Display Filter Reference: Transmission Control Protocol

Field name	Description	Type	Versions
mptcp.analysis.echoed_key_mismatch	Expert Info	Label	2.0.0 to 2.0.16
mptcp.analysis.missing_algorithm	Expert Info	Label	2.0.0 to 2.0.16
mptcp.analysis.unexpected_idsn	Expert Info	Label	2.0.0 to 2.0.16
mptcp.analysis.unsupported_algorithm	Expert Info	Label	2.0.0 to 2.0.16
mptcp.connection.echoed_key_mismatch	The echoed key in the ACK of the MPTCP handshake does not match the key of the SYN/ACK	Label	2.2.0 to 4.4.2
mptcp.connection.missing_algorithm	No crypto algorithm specified	Label	2.2.0 to 4.4.2
mptcp.connection.unsupported_algorithm	Unsupported algorithm	Label	2.2.0 to 4.4.2
mptcp.dss.infinite_mapping	Fallback to infinite mapping	Label	2.2.0 to 4.4.2
mptcp.dss.missing_mapping	No mapping available	Label	2.2.0 to 4.4.2
tcp.ack	Acknowledgment Number	Unsigned integer (32 bits)	1.0.0 to 4.4.2
tcp.ack.nonzero	The acknowledgment number field is nonzero while the ACK flag is not set	Label	1.12.0 to 4.4.2
tcp.ack_raw	Acknowledgment number (raw)	Unsigned integer (32 bits)	3.2.0 to 4.4.2
tcp.analysis	SEQ/ACK analysis	Label	1.8.0 to 4.4.2
tcp.analysis.ack_lost_segment	ACKed segment that wasn't captured (common at capture start)	Label	1.0.0 to 4.4.2
tcp.analysis.ack_rtt	The RTT to ACK the segment was	Time offset	1.0.0 to 4.4.2
tcp.analysis.acks_frame	This is an ACK to the segment in frame	Frame number	1.0.0 to 4.4.2
tcp.analysis.bytes_in_flight	Bytes in flight	Unsigned integer (32 bits)	1.2.0 to 4.4.2
tcp.analysis.duplicate_ack	Duplicate ACK	Label	1.0.0 to 4.4.2
tcp.analysis.duplicate_ack_frame	Duplicate to the ACK in frame	Frame number	1.0.0 to 4.4.2
tcp.analysis.duplicate_ack_num	Duplicate ACK #	Unsigned integer (32 bits)	1.0.0 to 4.4.2
tcp.analysis.fast_retransmission	This frame is a (suspected) fast retransmission	Label	1.0.0 to 4.4.2
tcp.analysis.flags	TCP Analysis Flags	Label	1.0.0 to 4.4.2
tcp.analysis.initial_rtt	iRTT	Time offset	1.12.0 to 4.4.2
tcp.analysis.keep_alive	TCP keep-alive segment	Label	1.0.0 to 4.4.2
tcp.analysis.keep_alive_ack	ACK to a TCP keep-alive segment	Label	1.0.0 to 4.4.2
tcp.analysis.lost_segment	Previous segment(s) not captured (common at capture start)	Label	1.0.0 to 4.4.2
tcp.analysis.out_of_order	This frame is a (suspected) out-of-order segment	Label	1.0.0 to 4.4.2
tcp.analysis.partial_ack	Partial Acknowledgement of a segment	Label	4.4.0 to 4.4.2
tcp.analysis.push_bytes_sent	Bytes sent since last PSH flag	Unsigned integer (32 bits)	2.2.0 to 4.4.2
tcp.analysis.retransmission	This frame is a (suspected) retransmission	Label	1.0.0 to 4.4.2
tcp.analysis.reused_ports	A new tcp session is started with the same ports as an earlier session in this trace	Label	1.0.0 to 4.4.2
tcp.analysis.rto	The RTO for this segment was	Time offset	1.0.0 to 4.4.2
tcp.analysis.rto_frame	RTO based on delta from frame	Frame number	1.0.0 to 4.4.2
tcp.analysis.spurious_retransmission	This frame is a (suspected) spurious retransmission	Label	1.12.0 to 4.4.2
tcp.analysis.tfo_ack	TCP SYN-ACK accepting TFO data	Label	3.4.0 to 4.4.2
tcp.analysis.tfo_ignored	TCP SYN-ACK ignoring TFO data	Label	3.4.0 to 4.4.2
tcp.analysis.tfo_syn	TCP SYN with TFO Cookie	Label	2.0.0 to 4.4.2
tcp.analysis.window_full	TCP window specified by the receiver is now completely full	Label	1.0.0 to 4.4.2
tcp.analysis.window_update	TCP window update	Label	1.0.0 to 4.4.2
tcp.analysis.zero_window	TCP Zero Window segment	Label	1.0.0 to 4.4.2
tcp.analysis.zero_window_probe	TCP Zero Window Probe	Label	1.0.0 to 4.4.2
tcp.analysis.zero_window_probe_ack	ACK to a TCP Zero Window Probe	Label	1.0.0 to 4.4.2
tcp.bogus_header_length	Bogus TCP Header length	Label	3.0.0 to 4.4.2
tcp.checksum	Checksum	Unsigned integer (16 bits)	1.0.0 to 4.4.2
tcp.checksum.ffff	TCP Checksum 0xffff instead of 0x0000 (see RFC 1624)	Label	1.12.0 to 4.4.2
tcp.checksum.partial	Partial (pseudo header) checksum (likely caused by "TCP checksum offload")	Label	4.2.0 to 4.4.2
tcp.checksum.status	Checksum Status	Unsigned integer (8 bits)	2.2.0 to 4.4.2
tcp.checksum_bad	Bad Checksum	Boolean	1.0.0 to 2.0.16
tcp.checksum_bad.expert	Bad checksum	Label	1.12.0 to 4.4.2
tcp.checksum_calculated	Calculated Checksum	Unsigned integer (16 bits)	1.12.0 to 4.4.2
tcp.checksum_good	Good Checksum	Boolean	1.0.0 to 2.0.16
tcp.completeness	Conversation completeness	Unsigned integer (8 bits)	3.6.0 to 4.4.2
tcp.completeness.ack	ACK	Boolean	4.2.0 to 4.4.2
tcp.completeness.data	Data	Boolean	4.2.0 to 4.4.2
tcp.completeness.fin	FIN	Boolean	4.2.0 to 4.4.2
tcp.completeness.rst	RST	Boolean	4.2.0 to 4.4.2
tcp.completeness.str	Completeness Flags	Character string	4.2.0 to 4.4.2
tcp.completeness.syn	SYN	Boolean	4.2.0 to 4.4.2
tcp.completeness.syn-ack	SYN-ACK	Boolean	4.2.0 to 4.4.2
tcp.connection.fin	Connection finish (FIN)	Label	1.12.0 to 4.4.2
tcp.connection.fin_active	This frame initiates the connection closing	Label	3.6.0 to 4.4.2
tcp.connection.fin_passive	This frame undergoes the connection closing	Label	3.6.0 to 4.4.2
tcp.connection.rst	Connection reset (RST)	Label	1.12.0 to 4.4.2
tcp.connection.sack	Connection establish acknowledge (SYN+ACK)	Label	1.12.0 to 3.2.18
tcp.connection.syn	Connection establish request (SYN)	Label	1.12.0 to 4.4.2
tcp.connection.synack	Connection establish acknowledge (SYN+ACK)	Label	3.4.0 to 4.4.2
tcp.continuation_to	This is a continuation to the PDU in frame	Frame number	1.0.0 to 4.4.2
tcp.data	TCP segment data	Byte sequence	1.4.5 to 1.8.15
tcp.dstport	Destination Port	Unsigned integer (16 bits)	1.0.0 to 4.4.2
tcp.fin_retransmission	Retransmission of FIN from frame	Frame number	2.0.0 to 4.4.2
tcp.flags	Flags	Unsigned integer (16 bits)	1.0.0 to 4.4.2
tcp.flags.ace	ACE	Unsigned integer (8 bits)	4.0.0 to 4.4.2
tcp.flags.ack	Acknowledgment	Boolean	1.0.0 to 4.4.2
tcp.flags.ae	Accurate ECN	Boolean	4.0.0 to 4.4.2
tcp.flags.cwr	Congestion Window Reduced	Boolean	1.0.0 to 4.4.2
tcp.flags.ece	ECN-Echo	Boolean	4.0.0 to 4.4.2
tcp.flags.ecn	ECN-Echo	Boolean	1.0.0 to 3.6.24
tcp.flags.fin	Fin	Boolean	1.0.0 to 4.4.2
tcp.flags.ns	Nonce	Boolean	1.4.1 to 3.6.24
tcp.flags.push	Push	Boolean	1.0.0 to 4.4.2
tcp.flags.res	Reserved	Boolean	1.4.1 to 4.4.2
tcp.flags.reset	Reset	Boolean	1.0.0 to 4.4.2
tcp.flags.str	TCP Flags	Character string	2.0.0 to 4.4.2
tcp.flags.syn	Syn	Boolean	1.0.0 to 4.4.2
tcp.flags.urg	Urgent	Boolean	1.0.0 to 4.4.2
tcp.hdr_len	Header Length	Unsigned integer (8 bits)	1.0.0 to 4.4.2
tcp.len	TCP Segment Len	Unsigned integer (32 bits)	1.0.0 to 4.4.2
tcp.non_zero_bytes_after_eol	Non zero bytes in option space after EOL option	Label	4.0.0 to 4.4.2
tcp.nop	4 NOP in a row - a router may have removed some options	Label	2.4.0 to 4.4.2
tcp.nstrace.rst.window_error_code	NetScaler TCP Reset Window Error Code	Character string	4.4.0 to 4.4.2
tcp.nxtseq	Next Sequence Number	Unsigned integer (32 bits)	1.0.0 to 4.4.2
tcp.option.len.invalid	Invalid length for option	Label	1.12.0 to 4.4.2
tcp.option_kind	Kind	Unsigned integer (8 bits)	1.6.0 to 4.4.2
tcp.option_len	Length	Unsigned integer (8 bits)	1.6.0 to 4.4.2
tcp.options	TCP Options	Byte sequence	1.0.0 to 4.4.2
tcp.options.acc_ecn.eceb	Accurate ECN Echo CE Byte Counter	Unsigned integer (24 bits)	4.0.0 to 4.4.2
tcp.options.acc_ecn.ee0b	Accurate ECN Echo ECT(0) Byte Counter	Unsigned integer (24 bits)	4.0.0 to 4.4.2
tcp.options.acc_ecn.ee1b	Accurate ECN Echo ECT(1) Byte Counter	Unsigned integer (24 bits)	4.0.0 to 4.4.2
tcp.options.ao.keyid	AO KeyID	Unsigned integer (8 bits)	3.6.0 to 4.4.2
tcp.options.ao.mac	AO MAC	Byte sequence	3.6.0 to 4.4.2
tcp.options.ao.rnextkeyid	AO RNextKeyID	Unsigned integer (8 bits)	3.6.0 to 4.4.2
tcp.options.cc	TCP CC Option	Boolean	1.0.0 to 2.2.17
tcp.options.cc_value	TCP CC Option	Unsigned integer (32 bits)	2.4.0 to 4.4.2
tcp.options.ccecho	TCP CC Echo Option	Boolean	1.0.0 to 1.8.15
tcp.options.ccnew	TCP CC New Option	Boolean	1.0.0 to 1.8.15
tcp.options.echo	TCP Echo Option	Boolean	1.0.0 to 2.2.17
tcp.options.echo_reply	TCP Echo Reply Option	Boolean	1.0.0 to 1.8.15
tcp.options.echo_value	TCP Echo Option	Unsigned integer (32 bits)	2.4.0 to 4.4.2
tcp.options.experimental	TCP Option - Experimental	Byte sequence	1.8.0 to 2.2.17
tcp.options.experimental.data	Data	Byte sequence	1.8.0 to 4.4.2
tcp.options.experimental.exid	Experiment Identifier	Unsigned integer (16 bits)	4.0.0 to 4.4.2
tcp.options.experimental.magic_number	Magic Number	Unsigned integer (16 bits)	1.10.0 to 3.6.24
tcp.options.md5	TCP MD5 Option	Boolean	1.0.0 to 1.8.15
tcp.options.md5.digest	MD5 digest	Byte sequence	2.4.0 to 4.4.2
tcp.options.mood	TCP Mood Option	Boolean	1.4.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.mood_val	TCP Mood Option Value	Character string	1.4.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.mptcp.addaddrtrunchmac	Truncated HMAC	Unsigned integer (64 bits)	2.2.0 to 4.4.2
tcp.options.mptcp.addrid	Address ID	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.backup.flag	Backup flag	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.checksum	Checksum	Unsigned integer (16 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.checksumreq.flags	Checksum required	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.dataack	Multipath TCP Data ACK	Unsigned integer (64 bits)	1.8.0 to 1.12.13
tcp.options.mptcp.dataack8.flag	Data ACK is 8 octets	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.dataackpresent.flag	Data ACK is present	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.datafin.flag	DATA_FIN	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.datalvllen	Data-level Length	Unsigned integer (16 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.dataseqno	Multipath TCP Data Sequence Number	Unsigned integer (64 bits)	1.8.0 to 1.12.13
tcp.options.mptcp.dseqn8.flag	Data Sequence Number is 8 octets	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.dseqnpresent.flag	Data Sequence Number, Subflow Sequence Number, Data-level Length, Checksum present	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.echo	Echo	Unsigned integer (8 bits)	3.4.0 to 4.4.2
tcp.options.mptcp.extensibility.flag	Extensibility	Unsigned integer (8 bits)	2.0.0 to 4.4.2
tcp.options.mptcp.flag_T.flag	Transient	Boolean	3.6.0 to 4.4.2
tcp.options.mptcp.flag_U.flag	Flag U	Boolean	3.6.0 to 4.4.2
tcp.options.mptcp.flag_V.flag	Flag V	Boolean	3.6.0 to 4.4.2
tcp.options.mptcp.flag_W.flag	Flag W	Boolean	3.6.0 to 4.4.2
tcp.options.mptcp.flags	Multipath TCP flags	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.ipv4	Advertised IPv4 Address	IPv4 address	1.8.0 to 4.4.2
tcp.options.mptcp.ipv6	Advertised IPv6 Address	IPv6 address	1.8.0 to 4.4.2
tcp.options.mptcp.ipver	IP version	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.nomoresubflows.flag	Do not attempt to establish new subflows to this address and port	Unsigned integer (8 bits)	3.6.0 to 4.4.2
tcp.options.mptcp.port	Advertised port	Unsigned integer (16 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.rawdataack	Original MPTCP Data ACK	Unsigned integer (64 bits)	2.0.0 to 4.4.2
tcp.options.mptcp.rawdataseqno	Data Sequence Number	Unsigned integer (64 bits)	2.0.0 to 4.4.2
tcp.options.mptcp.recvkey	Receiver's Key	Unsigned integer (64 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.recvtok	Receiver's Token	Unsigned integer (32 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.reserved	Reserved	Unsigned integer (16 bits)	2.0.0 to 4.4.2
tcp.options.mptcp.reserved.flag	Reserved	Unsigned integer (8 bits)	2.0.0 to 4.4.2
tcp.options.mptcp.rst_reason	TCPRST Reason	Unsigned integer (8 bits)	3.6.0 to 4.4.2
tcp.options.mptcp.sendhmac	Sender's HMAC	Byte sequence	2.0.0 to 4.4.2
tcp.options.mptcp.sendkey	Sender's Key	Unsigned integer (64 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.sendmac	Multipath TCP Sender's MAC	Unsigned integer (32 bits)	1.8.0 to 1.12.13
tcp.options.mptcp.sendrand	Sender's Random Number	Unsigned integer (32 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.sendtrunchmac	Sender's Truncated HMAC	Unsigned integer (64 bits)	2.0.0 to 4.4.2
tcp.options.mptcp.sendtruncmac	Multipath TCP Sender's Truncated MAC	Unsigned integer (64 bits)	1.8.0 to 1.12.13
tcp.options.mptcp.sha1.flag	Use HMAC-SHA1	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.sha256.flag	Use HMAC-SHA256	Unsigned integer (8 bits)	3.2.0 to 4.4.2
tcp.options.mptcp.subflowseqno	Subflow Sequence Number	Unsigned integer (32 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.subtype	Multipath TCP subtype	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mptcp.version	Multipath TCP version	Unsigned integer (8 bits)	1.8.0 to 4.4.2
tcp.options.mss	TCP MSS Option	Label	1.0.0 to 2.2.17
tcp.options.mss.absent	The SYN packet does not contain a MSS option	Label	3.2.0 to 4.4.2
tcp.options.mss.present	The non-SYN packet does contain a MSS option	Label	3.2.0 to 4.4.2
tcp.options.mss_val	MSS Value	Unsigned integer (16 bits)	1.0.0 to 4.4.2
tcp.options.qs	TCP QS Option	Boolean	1.0.0 to 2.2.17
tcp.options.qs.rate	QS Rate	Unsigned integer (8 bits)	2.4.0 to 4.4.2
tcp.options.qs.ttl_diff	QS Rate	Unsigned integer (8 bits)	2.4.0 to 4.4.2
tcp.options.rvbd.probe	Riverbed Probe	Boolean	1.6.0 to 2.2.17
tcp.options.rvbd.probe.appli_ver	Application Version	Unsigned integer (16 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.probe.client.ip	Client IP	IPv4 address	1.6.0 to 4.4.2
tcp.options.rvbd.probe.flags	Probe Flags	Unsigned integer (8 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.probe.flags.last	Last Notify	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.probe.flags.notcfe	Not CFE	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.probe.flags.probe	Disable Probe Cache on CSH	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.probe.flags.server	SSH outer to server established	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.probe.flags.ssl	SSL Enabled	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.probe.len	Length	Unsigned integer (8 bits)	1.6.0 to 2.4.16
tcp.options.rvbd.probe.prober	CSH IP	IPv4 address	1.6.0 to 4.4.2
tcp.options.rvbd.probe.proxy.ip	SSH IP	IPv4 address	1.6.0 to 4.4.2
tcp.options.rvbd.probe.proxy.port	SSH Port	Unsigned integer (16 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.probe.reserved	Reserved	Unsigned integer (8 bits)	2.0.0 to 4.4.2
tcp.options.rvbd.probe.storeid	CFE Store ID	Unsigned integer (32 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.probe.type1	Type	Unsigned integer (8 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.probe.type2	Type	Unsigned integer (8 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.probe.version	Version	Unsigned integer (8 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.probe.version_raw	Version	Unsigned integer (8 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.trpy	Riverbed Transparency	Boolean	1.6.0 to 2.2.17
tcp.options.rvbd.trpy.client.port	Out of band connection Client Port	Unsigned integer (16 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.dst.ip	Dst SH IP Addr	IPv4 address	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.dst.port	Dst SH Inner Port	Unsigned integer (16 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.flags	Transparency Options	Unsigned integer (16 bits)	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.flags.chksum	Reserved	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.flags.fw_rst	Enable Transparency FW feature on All FWs	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.flags.fw_rst_inner	Enable Inner FW feature on All FWs	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.flags.fw_rst_probe	Enable FW traversal feature	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.flags.mode	Transparency Mode	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.flags.oob	Out of band connection	Boolean	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.src.ip	Src SH IP Addr	IPv4 address	1.6.0 to 4.4.2
tcp.options.rvbd.trpy.src.port	Src SH Inner Port	Unsigned integer (16 bits)	1.6.0 to 4.4.2
tcp.options.sack	TCP SACK Option	Boolean	1.0.0 to 2.2.17
tcp.options.sack.count	TCP SACK Count	Unsigned integer (8 bits)	1.10.0 to 4.4.2
tcp.options.sack.dsack	D-SACK Sequence	Label	3.4.0 to 4.4.2
tcp.options.sack.dsack_le	TCP D-SACK Left Edge	Unsigned integer (32 bits)	3.4.0 to 4.4.2
tcp.options.sack.dsack_re	TCP D-SACK Right Edge	Unsigned integer (32 bits)	3.4.0 to 4.4.2
tcp.options.sack_le	TCP SACK Left Edge	Unsigned integer (32 bits)	1.0.0 to 4.4.2
tcp.options.sack_perm	TCP SACK Permitted Option	Boolean	1.0.0 to 2.2.17
tcp.options.sack_perm.absent	The SYN packet does not contain a SACK PERM option	Label	4.2.0 to 4.4.2
tcp.options.sack_perm.present	The non-SYN packet does contain a SACK PERM option	Label	4.2.0 to 4.4.2
tcp.options.sack_re	TCP SACK Right Edge	Unsigned integer (32 bits)	1.0.0 to 4.4.2
tcp.options.scps	TCP SCPS Capabilities Option	Boolean	1.2.0 to 2.2.17
tcp.options.scps.binding	Connection ID	Unsigned integer (8 bits)	1.2.0 to 4.4.2
tcp.options.scps.binding.data	Binding Space Data	Byte sequence	2.0.0 to 4.4.2
tcp.options.scps.binding.id	Binding Space (Community) ID	Unsigned integer (8 bits)	1.4.9 to 1.4.15, 1.6.2 to 4.4.2
tcp.options.scps.binding.len	Extended Capability Length	Unsigned integer (8 bits)	1.4.9 to 1.4.15, 1.6.2 to 4.4.2
tcp.options.scps.vector	TCP SCPS Capabilities Vector	Unsigned integer (8 bits)	1.2.0 to 4.4.2
tcp.options.scpsflags.bets	Partial Reliability Capable (BETS)	Boolean	1.2.0 to 4.4.2
tcp.options.scpsflags.compress	Lossless Header Compression (COMP)	Boolean	1.2.0 to 4.4.2
tcp.options.scpsflags.nlts	Network Layer Timestamp (NLTS)	Boolean	1.2.0 to 4.4.2
tcp.options.scpsflags.reserved	Reserved	Unsigned integer (8 bits)	1.4.11 to 1.4.15, 1.6.5 to 4.4.2
tcp.options.scpsflags.reserved1	Reserved Bit 1	Boolean	1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.reserved2	Reserved Bit 2	Boolean	1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.reserved3	Reserved Bit 3	Boolean	1.2.0 to 1.4.10, 1.6.0 to 1.6.4
tcp.options.scpsflags.snack1	Short Form SNACK Capable (SNACK1)	Boolean	1.2.0 to 4.4.2
tcp.options.scpsflags.snack2	Long Form SNACK Capable (SNACK2)	Boolean	1.2.0 to 4.4.2
tcp.options.snack	TCP Selective Negative Acknowledgment Option	Boolean	1.2.0 to 2.2.17
tcp.options.snack.le	TCP SNACK Left Edge	Unsigned integer (16 bits)	1.2.0 to 4.4.2
tcp.options.snack.offset	TCP SNACK Offset	Unsigned integer (16 bits)	1.2.0 to 4.4.2
tcp.options.snack.re	TCP SNACK Right Edge	Unsigned integer (16 bits)	1.2.0 to 4.4.2
tcp.options.snack.sequence	SNACK Sequence	Label	1.12.0 to 4.4.2
tcp.options.snack.size	TCP SNACK Size	Unsigned integer (16 bits)	1.2.0 to 4.4.2
tcp.options.tar.reserved	TARR Reserved	Unsigned integer (8 bits)	4.0.0 to 4.4.2
tcp.options.tarr.rate	TARR Rate	Unsigned integer (8 bits)	4.0.0 to 4.4.2
tcp.options.tfo	Fast Open Cookie	Label	1.10.0 to 2.2.17
tcp.options.tfo.cookie	Fast Open Cookie	Byte sequence	1.10.0 to 4.4.2
tcp.options.tfo.request	Fast Open Cookie Request	Label	1.10.0 to 4.4.2
tcp.options.time_stamp	TCP Time Stamp Option	Boolean	1.0.0 to 1.4.15
tcp.options.timestamp.tsecr	Timestamp echo reply	Unsigned integer (32 bits)	1.6.0 to 4.4.2
tcp.options.timestamp.tsval	Timestamp value	Unsigned integer (32 bits)	1.6.0 to 4.4.2
tcp.options.timestamp.tsval.syncookie.ecn	SYN Cookie ECN	Boolean	4.0.0 to 4.4.2
tcp.options.timestamp.tsval.syncookie.sack	SYN Cookie SACK	Boolean	4.0.0 to 4.4.2
tcp.options.timestamp.tsval.syncookie.timestamp	SYN Cookie Timestamp	Unsigned integer (32 bits)	4.0.0 to 4.4.2
tcp.options.timestamp.tsval.syncookie.wscale	SYN Cookie WScale	Unsigned integer (8 bits)	4.0.0 to 4.4.2
tcp.options.type	Type	Unsigned integer (8 bits)	1.10.1 to 2.2.17
tcp.options.type.class	Class	Unsigned integer (8 bits)	1.10.1 to 2.2.17
tcp.options.type.copy	Copy on fragmentation	Boolean	1.10.1 to 2.2.17
tcp.options.type.number	Number	Unsigned integer (8 bits)	1.10.1 to 2.2.17
tcp.options.unknown.payload	Payload	Byte sequence	2.6.0 to 4.4.2
tcp.options.user_to	TCP User Timeout	Boolean	1.6.0 to 2.2.17
tcp.options.user_to_granularity	Granularity	Boolean	1.6.0 to 4.4.2
tcp.options.user_to_val	User Timeout	Unsigned integer (16 bits)	1.6.0 to 4.4.2
tcp.options.wscale	TCP Window Scale Option	Boolean	1.0.0 to 1.4.15
tcp.options.wscale.multiplier	Multiplier	Unsigned integer (16 bits)	1.6.0 to 4.4.2
tcp.options.wscale.shift	Shift count	Unsigned integer (8 bits)	1.6.0 to 4.4.2
tcp.options.wscale.shift.invalid	Window scale shift exceeds 14	Label	2.0.0 to 4.4.2
tcp.options.wscale_val	TCP Windows Scale Option Value	Unsigned integer (8 bits)	1.0.0 to 1.4.15
tcp.payload	TCP payload	Byte sequence	2.4.0 to 4.4.2
tcp.pdu.last_frame	Last frame of this PDU	Frame number	1.0.0 to 4.4.2
tcp.pdu.size	PDU Size	Unsigned integer (32 bits)	1.0.0 to 4.4.2
tcp.pdu.time	Time until the last segment of this PDU	Time offset	1.0.0 to 4.4.2
tcp.port	Source or Destination Port	Unsigned integer (16 bits)	1.0.0 to 4.4.2
tcp.proc.dstcmd	Destination process name	Character string	1.2.0 to 4.4.2
tcp.proc.dstpid	Destination process ID	Unsigned integer (32 bits)	1.2.0 to 4.4.2
tcp.proc.dstuid	Destination process user ID	Unsigned integer (32 bits)	1.2.0 to 4.4.2
tcp.proc.dstuname	Destination process user name	Character string	1.2.0 to 4.4.2
tcp.proc.srccmd	Source process name	Character string	1.2.0 to 4.4.2
tcp.proc.srcpid	Source process ID	Unsigned integer (32 bits)	1.2.0 to 4.4.2
tcp.proc.srcuid	Source process user ID	Unsigned integer (32 bits)	1.2.0 to 4.4.2
tcp.proc.srcuname	Source process user name	Character string	1.2.0 to 4.4.2
tcp.reassembled.data	Reassembled TCP Data	Byte sequence	1.10.0 to 4.4.2
tcp.reassembled.length	Reassembled TCP length	Unsigned integer (32 bits)	1.4.0 to 4.4.2
tcp.reassembled_in	Reassembled PDU in frame	Frame number	1.0.0 to 4.4.2
tcp.reset_cause	Reset cause	Character string	2.0.0 to 4.4.2
tcp.segment	TCP Segment	Frame number	1.0.0 to 4.4.2
tcp.segment.count	Segment count	Unsigned integer (32 bits)	1.6.0 to 4.4.2
tcp.segment.error	Reassembling error	Frame number	1.0.0 to 4.4.2
tcp.segment.multipletails	Multiple tail segments found	Boolean	1.0.0 to 4.4.2
tcp.segment.overlap	Segment overlap	Boolean	1.0.0 to 4.4.2
tcp.segment.overlap.conflict	Conflicting data in segment overlap	Boolean	1.0.0 to 4.4.2
tcp.segment.toolongfragment	Segment too long	Boolean	1.0.0 to 4.4.2
tcp.segment_data	TCP segment data	Byte sequence	1.10.0 to 4.4.2
tcp.segments	Reassembled TCP Segments	Label	1.0.0 to 4.4.2
tcp.seq	Sequence Number	Unsigned integer (32 bits)	1.0.0 to 4.4.2
tcp.seq_raw	Sequence Number (raw)	Unsigned integer (32 bits)	3.2.0 to 4.4.2
tcp.short_segment	Short segment	Label	1.12.0 to 4.4.2
tcp.srcport	Source Port	Unsigned integer (16 bits)	1.0.0 to 4.4.2
tcp.stream	Stream index	Unsigned integer (32 bits)	1.2.0 to 4.4.2
tcp.stream.pnum	Stream Packet Number	Unsigned integer (32 bits)	4.4.0 to 4.4.2
tcp.suboption_malformed	suboption would go past end of option	Label	2.0.0 to 4.4.2
tcp.syncookie.hash	SYN Cookie hash	Unsigned integer (24 bits)	4.0.0 to 4.4.2
tcp.syncookie.mss	SYN Cookie Maximum Segment Size	Unsigned integer (8 bits)	4.0.0 to 4.4.2
tcp.syncookie.time	SYN Cookie Time	Unsigned integer (8 bits)	4.0.0 to 4.4.2
tcp.time_delta	Time since previous frame in this TCP stream	Time offset	1.0.0 to 4.4.2
tcp.time_relative	Time since first frame in this TCP stream	Time offset	1.0.0 to 4.4.2
tcp.urgent_pointer	Urgent Pointer	Unsigned integer (16 bits)	1.0.0 to 4.4.2
tcp.urgent_pointer.non_zero	The urgent pointer field is nonzero while the URG flag is not set	Label	1.12.0 to 4.4.2
tcp.window_size	Calculated window size	Unsigned integer (32 bits)	1.0.0 to 4.4.2
tcp.window_size_scalefactor	Window size scaling factor	Signed integer (32 bits)	1.6.0 to 4.4.2
tcp.window_size_value	Window	Unsigned integer (16 bits)	1.6.0 to 4.4.2