This wiki has been migrated to and is now deprecated. Please use that site instead.
Differences between revisions 2 and 3
Revision 2 as of 2004-09-14 14:52:20
Size: 2064
Editor: UlfLamping
Comment: added some links
Revision 3 as of 2004-09-24 17:07:07
Size: 2159
Editor: UlfLamping
Comment: add a display filter of tcp.port == 80
Deletions are marked like this. Additions are marked like this.
Line 44: Line 44:
 Show only the traffic to and from TCP port 80 (usually ["HTTP"]): {{{
 tcp.port == 80 }}}

Transmission Control Protocol (TCP)

The TCP protocol provides stream based connection oriented transfer of data of the InternetProtocolFamily.

It provides the described TCP port multiplexing and much more. It establishes a logical connection, which is reliable against the problems of PacketLoss, DuplicatePackets and such.

Sending a few bytes will transfer them to the remote host, without giving any additional faulty or missing bytes to the receiving application.


XXX - add a brief description of TCP history

Protocol dependencies

  • ["IP"]: Typically, TCP uses ["IP"] as it's underlying protocol. The well known protocol id for TCP on IP is 0x06.

Example traffic

XXX - Add example traffic here (as plain text or Ethereal screenshot).


TCP dissector is fully functional.

You can select a TCP stream very fast by using the Follow TCP stream feature. First select a TCP packet in the packet list pane and then click the menu item Analyze/Follow TCP Stream

There are two statistical menu items for TCP available: Statistics/Endpoints which contains a tab showing all TCP endpoints (combination of IP address and TCP port) and Statistics/Conversations, which contains a tab showing all TCP conversations (combination of two endpoints).

Preference Settings

(XXX add links to preference settings affecting how TCP is dissected).

Example capture file

XXX - Add a simple example capture file. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.

Display Filter

A complete list of TCP display filter fields can be found in the [ display filter reference]

  • Show only the TCP based traffic:


    Show only the traffic to and from TCP port 80 (usually ["HTTP"]):

     tcp.port == 80 

Capture Filter

  • Capture only the TCP based traffic:



Transmission_Control_Protocol (last edited 2020-07-23 02:19:27 by ChuckCraft)