How to filter tcp connection finish (FIN) initiated by certain IP
For example, I have two host 1.1.1.1
and 2.2.2.2
.
After capturing all traffic between them in certain time range, I would like to find all TCP connection finish initiated by 1.1.1.1
(i.e. 1.1.1.1
sent TCP FIN first in TCP connection termination)
To be clear: do you want to distinguish between TCP connection termination initiation by 1.1.1.1 and 2.2.2.2?
Do you want to specify the time range in the filter too?