tshark does not recognize tcp.analysis.initial_rtt
The Wireshark Display Filter "(tcp.flags==0x12) and not tcp.analysis.initial_rtt" works in Wireshark, but not tshark.
Problem:
My router is dropping SYN-ACK packets and NO-FLAG packets. I have about 12 hours worth of pcap files to sort through, so I created a script to loop through all pcap files in the directory, and delete any pcap file that does not contain SYN-ACK or NO-FLAG packets. I am now left with 284 files that contain to locate a total of 4 packets that were dropped.
Since the router should only drop SYN-ACK packets on half-open connections, the Wireshark display filter needs to include a check for the value of tcp.analysis.initial_rtt and the above display filter works. But it seems that Wireshark calculates tcp.analysis.initial_rtt, but tshark does not and I get the following error.
[bob@Linux dev]$ tshark -t ad -r "$fname" -Y "(tcp.flags==0x12) and not tcp.analysis.initial_rtt" tshark: "tcp.analysis.initial_rtt" is neither a field nor a protocol name.
Is there another way around this in tshark to find a half-open connect with tcp.flags==0x12?
What version of tshark are you using? I don't get an error with version 4.0.10.
An alternative filter is
tcp.completeness & 6 == 2
(has syn/ack but not ack). See TCPAnalysistshark -G fields | grep tcp.analysis.initial_rtt
to see if field is valid for your version oftshark
.Thank you for your responses. In reverse order,
(2) I have confirmed with the command line Chuckc provided that my version of tshark on CentOS 7 does not include the tcp.analysis.initial_rtt field.
(1) I have also confirmed that tshark on CentOS7 does not include the field tcp.completeness that André recommended.
tshark/wireshark on CentOS 7 is only version 1.10.14.
[root@Linux ~]# tshark -v TShark 1.10.14 (Git Rev Unknown from unknown)
Copyright 1998-2015 Gerald Combs [email protected] and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GLib 2.56.1, with libpcap, with libz 1.2.7, with POSIX capabilities (Linux), without libnl, with SMI 0.4.8, with c-ares 1.10.0, with Lua 5.1, without Python, with GnuTLS 3.3 ...(more)