 | 1 | initial version |
Not by a filter. A filter is basically a pass\fail for each individual packet to be displayed, it can't associate info between packets.
You might be able to cobble something together from the command line by inverting the filter to output the packets that are dropped and noting the tcp sequence numbers of those packets and then creating a filter for ACKs to those sequence numbers.
If you're only looking at higher layers in the stack you can drop all the tcp only packets by including a filter for the higher protocol, e.g. "http".
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
