Display Filter Reference: Transmission Control Protocol
Protocol field name: tcp
Versions: 1.0.0 to 3.4.5
Back to Display Filter Reference
| Field name | Description | Type | Versions |
|---|---|---|---|
| mptcp.analysis.echoed_key_mismatch | Expert Info | Label | 2.0.0 to 2.0.16 |
| mptcp.analysis.missing_algorithm | Expert Info | Label | 2.0.0 to 2.0.16 |
| mptcp.analysis.unexpected_idsn | Expert Info | Label | 2.0.0 to 2.0.16 |
| mptcp.analysis.unsupported_algorithm | Expert Info | Label | 2.0.0 to 2.0.16 |
| mptcp.connection.echoed_key_mismatch | The echoed key in the ACK of the MPTCP handshake does not match the key of the SYN/ACK | Label | 2.2.0 to 3.4.5 |
| mptcp.connection.missing_algorithm | No crypto algorithm specified | Label | 2.2.0 to 3.4.5 |
| mptcp.connection.unsupported_algorithm | Unsupported algorithm | Label | 2.2.0 to 3.4.5 |
| mptcp.dss.infinite_mapping | Fallback to infinite mapping | Label | 2.2.0 to 3.4.5 |
| mptcp.dss.missing_mapping | No mapping available | Label | 2.2.0 to 3.4.5 |
| tcp.ack | Acknowledgment Number | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| tcp.ack.nonzero | The acknowledgment number field is nonzero while the ACK flag is not set | Label | 1.12.0 to 3.4.5 |
| tcp.ack_raw | Acknowledgment number (raw) | Unsigned integer, 4 bytes | 3.2.0 to 3.4.5 |
| tcp.analysis | SEQ/ACK analysis | Label | 1.8.0 to 3.4.5 |
| tcp.analysis.ack_lost_segment | ACKed segment that wasn\'t captured (common at capture start) | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.ack_rtt | The RTT to ACK the segment was | Time offset | 1.0.0 to 3.4.5 |
| tcp.analysis.acks_frame | This is an ACK to the segment in frame | Frame number | 1.0.0 to 3.4.5 |
| tcp.analysis.bytes_in_flight | Bytes in flight | Unsigned integer, 4 bytes | 1.2.0 to 3.4.5 |
| tcp.analysis.duplicate_ack | Duplicate ACK | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.duplicate_ack_frame | Duplicate to the ACK in frame | Frame number | 1.0.0 to 3.4.5 |
| tcp.analysis.duplicate_ack_num | Duplicate ACK # | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| tcp.analysis.fast_retransmission | This frame is a (suspected) fast retransmission | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.flags | TCP Analysis Flags | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.initial_rtt | iRTT | Time offset | 1.12.0 to 3.4.5 |
| tcp.analysis.keep_alive | TCP keep-alive segment | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.keep_alive_ack | ACK to a TCP keep-alive segment | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.lost_segment | Previous segment(s) not captured (common at capture start) | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.out_of_order | This frame is a (suspected) out-of-order segment | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.push_bytes_sent | Bytes sent since last PSH flag | Unsigned integer, 4 bytes | 2.2.0 to 3.4.5 |
| tcp.analysis.retransmission | This frame is a (suspected) retransmission | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.reused_ports | A new tcp session is started with the same ports as an earlier session in this trace | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.rto | The RTO for this segment was | Time offset | 1.0.0 to 3.4.5 |
| tcp.analysis.rto_frame | RTO based on delta from frame | Frame number | 1.0.0 to 3.4.5 |
| tcp.analysis.spurious_retransmission | This frame is a (suspected) spurious retransmission | Label | 1.12.0 to 3.4.5 |
| tcp.analysis.tfo_ack | TCP SYN-ACK accepting TFO data | Label | 3.4.0 to 3.4.5 |
| tcp.analysis.tfo_ignored | TCP SYN-ACK ignoring TFO data | Label | 3.4.0 to 3.4.5 |
| tcp.analysis.tfo_syn | TCP SYN with TFO Cookie | Label | 2.0.0 to 3.4.5 |
| tcp.analysis.window_full | TCP window specified by the receiver is now completely full | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.window_update | TCP window update | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.zero_window | TCP Zero Window segment | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.zero_window_probe | TCP Zero Window Probe | Label | 1.0.0 to 3.4.5 |
| tcp.analysis.zero_window_probe_ack | ACK to a TCP Zero Window Probe | Label | 1.0.0 to 3.4.5 |
| tcp.bogus_header_length | Bogus TCP Header length | Label | 3.0.0 to 3.4.5 |
| tcp.checksum | Checksum | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| tcp.checksum.ffff | TCP Checksum 0xffff instead of 0x0000 (see RFC 1624) | Label | 1.12.0 to 3.4.5 |
| tcp.checksum.status | Checksum Status | Unsigned integer, 1 byte | 2.2.0 to 3.4.5 |
| tcp.checksum_bad | Bad Checksum | Boolean | 1.0.0 to 2.0.16 |
| tcp.checksum_bad.expert | Bad checksum | Label | 1.12.0 to 3.4.5 |
| tcp.checksum_calculated | Calculated Checksum | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| tcp.checksum_good | Good Checksum | Boolean | 1.0.0 to 2.0.16 |
| tcp.connection.fin | Connection finish (FIN) | Label | 1.12.0 to 3.4.5 |
| tcp.connection.rst | Connection reset (RST) | Label | 1.12.0 to 3.4.5 |
| tcp.connection.sack | Connection establish acknowledge (SYN+ACK) | Label | 1.12.0 to 3.2.13 |
| tcp.connection.syn | Connection establish request (SYN) | Label | 1.12.0 to 3.4.5 |
| tcp.connection.synack | Connection establish acknowledge (SYN+ACK) | Label | 3.4.0 to 3.4.5 |
| tcp.continuation_to | This is a continuation to the PDU in frame | Frame number | 1.0.0 to 3.4.5 |
| tcp.data | TCP segment data | Sequence of bytes | 1.4.5 to 1.8.15 |
| tcp.dstport | Destination Port | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| tcp.fin_retransmission | Retransmission of FIN from frame | Frame number | 2.0.0 to 3.4.5 |
| tcp.flags | Flags | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| tcp.flags.ack | Acknowledgment | Boolean | 1.0.0 to 3.4.5 |
| tcp.flags.cwr | Congestion Window Reduced (CWR) | Boolean | 1.0.0 to 3.4.5 |
| tcp.flags.ecn | ECN-Echo | Boolean | 1.0.0 to 3.4.5 |
| tcp.flags.fin | Fin | Boolean | 1.0.0 to 3.4.5 |
| tcp.flags.ns | Nonce | Boolean | 1.4.1 to 3.4.5 |
| tcp.flags.push | Push | Boolean | 1.0.0 to 3.4.5 |
| tcp.flags.res | Reserved | Boolean | 1.4.1 to 3.4.5 |
| tcp.flags.reset | Reset | Boolean | 1.0.0 to 3.4.5 |
| tcp.flags.str | TCP Flags | Character string | 2.0.0 to 3.4.5 |
| tcp.flags.syn | Syn | Boolean | 1.0.0 to 3.4.5 |
| tcp.flags.urg | Urgent | Boolean | 1.0.0 to 3.4.5 |
| tcp.hdr_len | Header Length | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| tcp.len | TCP Segment Len | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| tcp.nop | 4 NOP in a row - a router may have removed some options | Label | 2.4.0 to 3.4.5 |
| tcp.nxtseq | Next Sequence Number | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| tcp.option.len.invalid | Invalid length for option | Label | 1.12.0 to 3.4.5 |
| tcp.option_kind | Kind | Unsigned integer, 1 byte | 1.6.0 to 3.4.5 |
| tcp.option_len | Length | Unsigned integer, 1 byte | 1.6.0 to 3.4.5 |
| tcp.options | TCP Options | Sequence of bytes | 1.0.0 to 3.4.5 |
| tcp.options.cc | TCP CC Option | Boolean | 1.0.0 to 2.2.17 |
| tcp.options.cc_value | TCP CC Option | Unsigned integer, 4 bytes | 2.4.0 to 3.4.5 |
| tcp.options.ccecho | TCP CC Echo Option | Boolean | 1.0.0 to 1.8.15 |
| tcp.options.ccnew | TCP CC New Option | Boolean | 1.0.0 to 1.8.15 |
| tcp.options.echo | TCP Echo Option | Boolean | 1.0.0 to 2.2.17 |
| tcp.options.echo_reply | TCP Echo Reply Option | Boolean | 1.0.0 to 1.8.15 |
| tcp.options.echo_value | TCP Echo Option | Unsigned integer, 4 bytes | 2.4.0 to 3.4.5 |
| tcp.options.experimental | TCP Option - Experimental | Sequence of bytes | 1.8.0 to 2.2.17 |
| tcp.options.experimental.data | Data | Sequence of bytes | 1.8.0 to 3.4.5 |
| tcp.options.experimental.magic_number | Magic Number | Unsigned integer, 2 bytes | 1.10.0 to 3.4.5 |
| tcp.options.md5 | TCP MD5 Option | Boolean | 1.0.0 to 1.8.15 |
| tcp.options.md5.digest | MD5 digest | Sequence of bytes | 2.4.0 to 3.4.5 |
| tcp.options.mood | TCP Mood Option | Boolean | 1.4.0 to 1.4.10, 1.6.0 to 1.6.4 |
| tcp.options.mood_val | TCP Mood Option Value | Character string | 1.4.0 to 1.4.10, 1.6.0 to 1.6.4 |
| tcp.options.mptcp.addaddrtrunchmac | Truncated HMAC | Unsigned integer, 8 bytes | 2.2.0 to 3.4.5 |
| tcp.options.mptcp.addrid | Address ID | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.backup.flag | Backup flag | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.checksum | Checksum | Unsigned integer, 2 bytes | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.checksumreq.flags | Checksum required | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.dataack | Multipath TCP Data ACK | Unsigned integer, 8 bytes | 1.8.0 to 1.12.13 |
| tcp.options.mptcp.dataack8.flag | Data ACK is 8 octets | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.dataackpresent.flag | Data ACK is present | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.datafin.flag | DATA_FIN | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.datalvllen | Data-level Length | Unsigned integer, 2 bytes | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.dataseqno | Multipath TCP Data Sequence Number | Unsigned integer, 8 bytes | 1.8.0 to 1.12.13 |
| tcp.options.mptcp.dseqn8.flag | Data Sequence Number is 8 octets | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.dseqnpresent.flag | Data Sequence Number, Subflow Sequence Number, Data-level Length, Checksum present | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.echo | Echo | Unsigned integer, 1 byte | 3.4.0 to 3.4.5 |
| tcp.options.mptcp.extensibility.flag | Extensibility | Unsigned integer, 1 byte | 2.0.0 to 3.4.5 |
| tcp.options.mptcp.flags | Multipath TCP flags | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.ipv4 | Advertised IPv4 Address | IPv4 address | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.ipv6 | Advertised IPv6 Address | IPv6 address | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.ipver | IP version | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.port | Advertised port | Unsigned integer, 2 bytes | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.rawdataack | Original MPTCP Data ACK | Unsigned integer, 8 bytes | 2.0.0 to 3.4.5 |
| tcp.options.mptcp.rawdataseqno | Data Sequence Number | Unsigned integer, 8 bytes | 2.0.0 to 3.4.5 |
| tcp.options.mptcp.recvkey | Receiver\'s Key | Unsigned integer, 8 bytes | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.recvtok | Receiver\'s Token | Unsigned integer, 4 bytes | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.reserved | Reserved | Unsigned integer, 2 bytes | 2.0.0 to 3.4.5 |
| tcp.options.mptcp.reserved.flag | Reserved | Unsigned integer, 1 byte | 2.0.0 to 3.4.5 |
| tcp.options.mptcp.sendhmac | Sender\'s HMAC | Sequence of bytes | 2.0.0 to 3.4.5 |
| tcp.options.mptcp.sendkey | Sender\'s Key | Unsigned integer, 8 bytes | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.sendmac | Multipath TCP Sender\'s MAC | Unsigned integer, 4 bytes | 1.8.0 to 1.12.13 |
| tcp.options.mptcp.sendrand | Sender\'s Random Number | Unsigned integer, 4 bytes | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.sendtrunchmac | Sender\'s Truncated HMAC | Unsigned integer, 8 bytes | 2.0.0 to 3.4.5 |
| tcp.options.mptcp.sendtruncmac | Multipath TCP Sender\'s Truncated MAC | Unsigned integer, 8 bytes | 1.8.0 to 1.12.13 |
| tcp.options.mptcp.sha1.flag | Use HMAC-SHA1 | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.sha256.flag | Use HMAC-SHA256 | Unsigned integer, 1 byte | 3.2.0 to 3.4.5 |
| tcp.options.mptcp.subflowseqno | Subflow Sequence Number | Unsigned integer, 4 bytes | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.subtype | Multipath TCP subtype | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mptcp.version | Multipath TCP version | Unsigned integer, 1 byte | 1.8.0 to 3.4.5 |
| tcp.options.mss | TCP MSS Option | Label | 1.0.0 to 2.2.17 |
| tcp.options.mss.absent | The SYN packet does not contain a MSS option | Label | 3.2.0 to 3.4.5 |
| tcp.options.mss.present | The non-SYN packet does contain a MSS option | Label | 3.2.0 to 3.4.5 |
| tcp.options.mss_val | MSS Value | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| tcp.options.qs | TCP QS Option | Boolean | 1.0.0 to 2.2.17 |
| tcp.options.qs.rate | QS Rate | Unsigned integer, 1 byte | 2.4.0 to 3.4.5 |
| tcp.options.qs.ttl_diff | QS Rate | Unsigned integer, 1 byte | 2.4.0 to 3.4.5 |
| tcp.options.rvbd.probe | Riverbed Probe | Boolean | 1.6.0 to 2.2.17 |
| tcp.options.rvbd.probe.appli_ver | Application Version | Unsigned integer, 2 bytes | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.client.ip | Client IP | IPv4 address | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.flags | Probe Flags | Unsigned integer, 1 byte | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.flags.last | Last Notify | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.flags.notcfe | Not CFE | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.flags.probe | Disable Probe Cache on CSH | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.flags.server | SSH outer to server established | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.flags.ssl | SSL Enabled | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.len | Length | Unsigned integer, 1 byte | 1.6.0 to 2.4.16 |
| tcp.options.rvbd.probe.prober | CSH IP | IPv4 address | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.proxy.ip | SSH IP | IPv4 address | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.proxy.port | SSH Port | Unsigned integer, 2 bytes | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.reserved | Reserved | Unsigned integer, 1 byte | 2.0.0 to 3.4.5 |
| tcp.options.rvbd.probe.storeid | CFE Store ID | Unsigned integer, 4 bytes | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.type1 | Type | Unsigned integer, 1 byte | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.type2 | Type | Unsigned integer, 1 byte | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.version | Version | Unsigned integer, 1 byte | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.probe.version_raw | Version | Unsigned integer, 1 byte | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy | Riverbed Transparency | Boolean | 1.6.0 to 2.2.17 |
| tcp.options.rvbd.trpy.client.port | Out of band connection Client Port | Unsigned integer, 2 bytes | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.dst.ip | Dst SH IP Addr | IPv4 address | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.dst.port | Dst SH Inner Port | Unsigned integer, 2 bytes | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.flags | Transparency Options | Unsigned integer, 2 bytes | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.flags.chksum | Reserved | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.flags.fw_rst | Enable Transparency FW feature on All FWs | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.flags.fw_rst_inner | Enable Inner FW feature on All FWs | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.flags.fw_rst_probe | Enable FW traversal feature | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.flags.mode | Transparency Mode | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.flags.oob | Out of band connection | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.src.ip | Src SH IP Addr | IPv4 address | 1.6.0 to 3.4.5 |
| tcp.options.rvbd.trpy.src.port | Src SH Inner Port | Unsigned integer, 2 bytes | 1.6.0 to 3.4.5 |
| tcp.options.sack | TCP SACK Option | Boolean | 1.0.0 to 2.2.17 |
| tcp.options.sack.count | TCP SACK Count | Unsigned integer, 1 byte | 1.10.0 to 3.4.5 |
| tcp.options.sack.dsack | D-SACK Sequence | Label | 3.4.0 to 3.4.5 |
| tcp.options.sack.dsack_le | TCP D-SACK Left Edge | Unsigned integer, 4 bytes | 3.4.0 to 3.4.5 |
| tcp.options.sack.dsack_re | TCP D-SACK Right Edge | Unsigned integer, 4 bytes | 3.4.0 to 3.4.5 |
| tcp.options.sack_le | TCP SACK Left Edge | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| tcp.options.sack_perm | TCP SACK Permitted Option | Boolean | 1.0.0 to 2.2.17 |
| tcp.options.sack_re | TCP SACK Right Edge | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| tcp.options.scps | TCP SCPS Capabilities Option | Boolean | 1.2.0 to 2.2.17 |
| tcp.options.scps.binding | Connection ID | Unsigned integer, 1 byte | 1.2.0 to 3.4.5 |
| tcp.options.scps.binding.data | Binding Space Data | Sequence of bytes | 2.0.0 to 3.4.5 |
| tcp.options.scps.binding.id | Binding Space (Community) ID | Unsigned integer, 1 byte | 1.4.9 to 1.4.15, 1.6.2 to 3.4.5 |
| tcp.options.scps.binding.len | Extended Capability Length | Unsigned integer, 1 byte | 1.4.9 to 1.4.15, 1.6.2 to 3.4.5 |
| tcp.options.scps.vector | TCP SCPS Capabilities Vector | Unsigned integer, 1 byte | 1.2.0 to 3.4.5 |
| tcp.options.scpsflags.bets | Partial Reliability Capable (BETS) | Boolean | 1.2.0 to 3.4.5 |
| tcp.options.scpsflags.compress | Lossless Header Compression (COMP) | Boolean | 1.2.0 to 3.4.5 |
| tcp.options.scpsflags.nlts | Network Layer Timestamp (NLTS) | Boolean | 1.2.0 to 3.4.5 |
| tcp.options.scpsflags.reserved | Reserved | Unsigned integer, 1 byte | 1.4.11 to 1.4.15, 1.6.5 to 3.4.5 |
| tcp.options.scpsflags.reserved1 | Reserved Bit 1 | Boolean | 1.2.0 to 1.4.10, 1.6.0 to 1.6.4 |
| tcp.options.scpsflags.reserved2 | Reserved Bit 2 | Boolean | 1.2.0 to 1.4.10, 1.6.0 to 1.6.4 |
| tcp.options.scpsflags.reserved3 | Reserved Bit 3 | Boolean | 1.2.0 to 1.4.10, 1.6.0 to 1.6.4 |
| tcp.options.scpsflags.snack1 | Short Form SNACK Capable (SNACK1) | Boolean | 1.2.0 to 3.4.5 |
| tcp.options.scpsflags.snack2 | Long Form SNACK Capable (SNACK2) | Boolean | 1.2.0 to 3.4.5 |
| tcp.options.snack | TCP Selective Negative Acknowledgment Option | Boolean | 1.2.0 to 2.2.17 |
| tcp.options.snack.le | TCP SNACK Left Edge | Unsigned integer, 2 bytes | 1.2.0 to 3.4.5 |
| tcp.options.snack.offset | TCP SNACK Offset | Unsigned integer, 2 bytes | 1.2.0 to 3.4.5 |
| tcp.options.snack.re | TCP SNACK Right Edge | Unsigned integer, 2 bytes | 1.2.0 to 3.4.5 |
| tcp.options.snack.sequence | SNACK Sequence | Label | 1.12.0 to 3.4.5 |
| tcp.options.snack.size | TCP SNACK Size | Unsigned integer, 2 bytes | 1.2.0 to 3.4.5 |
| tcp.options.tfo | Fast Open Cookie | Label | 1.10.0 to 2.2.17 |
| tcp.options.tfo.cookie | Fast Open Cookie | Sequence of bytes | 1.10.0 to 3.4.5 |
| tcp.options.tfo.request | Fast Open Cookie Request | Label | 1.10.0 to 3.4.5 |
| tcp.options.time_stamp | TCP Time Stamp Option | Boolean | 1.0.0 to 1.4.15 |
| tcp.options.timestamp.tsecr | Timestamp echo reply | Unsigned integer, 4 bytes | 1.6.0 to 3.4.5 |
| tcp.options.timestamp.tsval | Timestamp value | Unsigned integer, 4 bytes | 1.6.0 to 3.4.5 |
| tcp.options.type | Type | Unsigned integer, 1 byte | 1.10.1 to 2.2.17 |
| tcp.options.type.class | Class | Unsigned integer, 1 byte | 1.10.1 to 2.2.17 |
| tcp.options.type.copy | Copy on fragmentation | Boolean | 1.10.1 to 2.2.17 |
| tcp.options.type.number | Number | Unsigned integer, 1 byte | 1.10.1 to 2.2.17 |
| tcp.options.unknown.payload | Payload | Sequence of bytes | 2.6.0 to 3.4.5 |
| tcp.options.user_to | TCP User Timeout | Boolean | 1.6.0 to 2.2.17 |
| tcp.options.user_to_granularity | Granularity | Boolean | 1.6.0 to 3.4.5 |
| tcp.options.user_to_val | User Timeout | Unsigned integer, 2 bytes | 1.6.0 to 3.4.5 |
| tcp.options.wscale | TCP Window Scale Option | Boolean | 1.0.0 to 1.4.15 |
| tcp.options.wscale.multiplier | Multiplier | Unsigned integer, 2 bytes | 1.6.0 to 3.4.5 |
| tcp.options.wscale.shift | Shift count | Unsigned integer, 1 byte | 1.6.0 to 3.4.5 |
| tcp.options.wscale.shift.invalid | Window scale shift exceeds 14 | Label | 2.0.0 to 3.4.5 |
| tcp.options.wscale_val | TCP Windows Scale Option Value | Unsigned integer, 1 byte | 1.0.0 to 1.4.15 |
| tcp.payload | TCP payload | Sequence of bytes | 2.4.0 to 3.4.5 |
| tcp.pdu.last_frame | Last frame of this PDU | Frame number | 1.0.0 to 3.4.5 |
| tcp.pdu.size | PDU Size | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| tcp.pdu.time | Time until the last segment of this PDU | Time offset | 1.0.0 to 3.4.5 |
| tcp.port | Source or Destination Port | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| tcp.proc.dstcmd | Destination process name | Character string | 1.2.0 to 3.4.5 |
| tcp.proc.dstpid | Destination process ID | Unsigned integer, 4 bytes | 1.2.0 to 3.4.5 |
| tcp.proc.dstuid | Destination process user ID | Unsigned integer, 4 bytes | 1.2.0 to 3.4.5 |
| tcp.proc.dstuname | Destination process user name | Character string | 1.2.0 to 3.4.5 |
| tcp.proc.srccmd | Source process name | Character string | 1.2.0 to 3.4.5 |
| tcp.proc.srcpid | Source process ID | Unsigned integer, 4 bytes | 1.2.0 to 3.4.5 |
| tcp.proc.srcuid | Source process user ID | Unsigned integer, 4 bytes | 1.2.0 to 3.4.5 |
| tcp.proc.srcuname | Source process user name | Character string | 1.2.0 to 3.4.5 |
| tcp.reassembled.data | Reassembled TCP Data | Sequence of bytes | 1.10.0 to 3.4.5 |
| tcp.reassembled.length | Reassembled TCP length | Unsigned integer, 4 bytes | 1.4.0 to 3.4.5 |
| tcp.reassembled_in | Reassembled PDU in frame | Frame number | 1.0.0 to 3.4.5 |
| tcp.reset_cause | Reset cause | Character string | 2.0.0 to 3.4.5 |
| tcp.segment | TCP Segment | Frame number | 1.0.0 to 3.4.5 |
| tcp.segment.count | Segment count | Unsigned integer, 4 bytes | 1.6.0 to 3.4.5 |
| tcp.segment.error | Reassembling error | Frame number | 1.0.0 to 3.4.5 |
| tcp.segment.multipletails | Multiple tail segments found | Boolean | 1.0.0 to 3.4.5 |
| tcp.segment.overlap | Segment overlap | Boolean | 1.0.0 to 3.4.5 |
| tcp.segment.overlap.conflict | Conflicting data in segment overlap | Boolean | 1.0.0 to 3.4.5 |
| tcp.segment.toolongfragment | Segment too long | Boolean | 1.0.0 to 3.4.5 |
| tcp.segment_data | TCP segment data | Sequence of bytes | 1.10.0 to 3.4.5 |
| tcp.segments | Reassembled TCP Segments | Label | 1.0.0 to 3.4.5 |
| tcp.seq | Sequence Number | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| tcp.seq_raw | Sequence Number (raw) | Unsigned integer, 4 bytes | 3.2.0 to 3.4.5 |
| tcp.short_segment | Short segment | Label | 1.12.0 to 3.4.5 |
| tcp.srcport | Source Port | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| tcp.stream | Stream index | Unsigned integer, 4 bytes | 1.2.0 to 3.4.5 |
| tcp.suboption_malformed | suboption would go past end of option | Label | 2.0.0 to 3.4.5 |
| tcp.time_delta | Time since previous frame in this TCP stream | Time offset | 1.0.0 to 3.4.5 |
| tcp.time_relative | Time since first frame in this TCP stream | Time offset | 1.0.0 to 3.4.5 |
| tcp.urgent_pointer | Urgent Pointer | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| tcp.urgent_pointer.non_zero | The urgent pointer field is nonzero while the URG flag is not set | Label | 1.12.0 to 3.4.5 |
| tcp.window_size | Calculated window size | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| tcp.window_size_scalefactor | Window size scaling factor | Signed integer, 4 bytes | 1.6.0 to 3.4.5 |
| tcp.window_size_value | Window | Unsigned integer, 2 bytes | 1.6.0 to 3.4.5 |
Go Beyond with Riverbed Technology
I have a lot of traffic...
ANSWER: SteelCentral™ AppResponse 11
- • Full stack analysis – from packets to pages
- • Rich performance metrics & pre-defined insights for fast problem identification/resolution
- • Modular, flexible solution for deeply-analyzing network & application performance