Revision history [back]

There is a field for this in the current development branch (3.5).

#13210: Feature request: improve the tcp.analysis filter so it can find active or passive TCP close

ip.src == 1.1.1.1 and tcp.connection.fin_active

The fields added in the change do appear in a 3.5.0rc0 build available in the automated build section of the download site.
There may even be a 3.5.0 (not rc) release in the next few days.
Wireshark expected release dates: Roadmap

There is a field for this in the current development branch (3.5).

#13210: Feature request: improve the tcp.analysis filter so it can find active or passive TCP close

ip.src (ip.src == 1.1.1.1 1.1.1.1) and tcp.connection.fin_active
(tcp.connection.fin_active)

The fields added in the change do appear in a 3.5.0rc0 build available in the automated build section of the download site.
There may even be a 3.5.0 (not rc) release in the next few days.
Wireshark expected release dates: Roadmap

There is a field for this in the current development branch (3.5).

#13210: Feature request: improve the tcp.analysis filter so it can find active or passive TCP close

(ip.src == 1.1.1.1) and && (tcp.connection.fin_active)

The fields added in the change do appear in a 3.5.0rc0 build available in the automated build section of the download site.
There may even be a 3.5.0 (not rc) release in the next few days.
Wireshark expected release dates: Roadmap