Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Using tshark to get message from TCP RESET

How I can get the message from payload using the tshark? For example, the message below is showing "Message: Connection reset (RST)"

Transmission Control Protocol, Src Port: http (80), Dst Port: norton-lambert (2338), Seq: 1406431331, Len: 0 Source port: http (80) Destination port: norton-lambert (2338) [Stream index: 3] Sequence number: 1406431331 Header length: 20 bytes Flags: 0x004 (RST) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...0 .... = Acknowledgment: Not set .... .... 0... = Push: Not set .... .... .1.. = Reset: Set [Expert Info (Chat/Sequence): Connection reset (RST)] [Message: Connection reset (RST)] [Severity level: Chat] [Group: Sequence] .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set

Using tshark to get message from TCP RESET

How I can get the message from payload using the tshark? For example, the message below is showing "Message: Connection reset (RST)"

Transmission Control Protocol, Src Port: http (80), Dst Port: norton-lambert (2338), Seq: 1406431331, Len: 0
    Source port: http (80)
    Destination port: norton-lambert (2338)
    [Stream index: 3]
    Sequence number: 1406431331
    Header length: 20 bytes
    Flags: 0x004 (RST)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...0 .... = Acknowledgment: Not set
        .... .... 0... = Push: Not set
        .... .... .1.. = Reset: Set
            [Expert Info (Chat/Sequence): Connection reset (RST)]
                [Message: **[Message: Connection reset (RST)] (RST)]**
                [Severity level: Chat]
                [Group: Sequence]
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set

set