Wireshark - How to find Connection Timeout TCP packets?

Connection Timeout in TCP happens after TCP has send multiple attempts of SYN packets but did not received a respond from the remote destination. Based on this, we could try to filter tcpdump by SYN flag and locate those that has multiple one directional packet.

The steps in Wireshark as follows

1) Filter by 'tcp.flags eq 0x02' (only SYN flag set)


2) Then select Statistics -> Conversations


3) Then, 

a) Select on "Limit to display filter". Limit to display filter will only show conversations matching the current display filter

b) Select TCP tab

c) Sort by Packets

Those that had more than 1 SYN packets are likely retransmission TCP packets



4) To drill in, right click on the "Apply as Filter" -> "Selected" > "A <->B"




5) You will see a packet trace on the TCP retransmission of SYN packet. That mean Connection Timeout.








Comments

Popular Posts