 | 1 | initial version |
Unfortunately, there's currently no filter to check for that (unlike, for example, checking for the time between the initial SYN and the SYN+ACK response).
You could try
tcp.analysis.ack_rtt > .5
to find all packets with an ACK that's more than .5 seconds (500 ms) after the packet being ACKed.