| Check out these great references as well: |
|---|
| Our custom profiles repository for Wireshark |
| Our Udemy course on Wireshark |
| Our Udemy course on Wireless Packet capture |
Introduced in version 3.6 and later is a new Wireshark expert analysis process called TCP Completeness. At first this was quite confusing, but once you get to know what is going on, you come to understand that you can use this new feature to find certain types of TCP issues. We included this is our TCP Troubleshooting Profile almost immediately, and have updated the profile multiple times as more clarity has been attained with regards to how we can use the feature.
Normal Completeness
Let’s start with a simple understanding of how TCP Completeness works when everything is normal. TCP is a stateful and connection oriented protocol. This means that a good TCP connection goes through three phases:
- Connection Establishment (SYN – SYN, ACK – ACK)
- Data Transfer
- Connection Termination (FIN, FIN-ACK, FIN, FIN-ACK)
What we have below is a simple TCP session that goes through all three phases perfectly in 10 total packets:
If you look into the TCP header, you will see the TCP Completeness information that is in brackets, meaning this information is not actually in the packet headers, but rather has been added by the Wireshark Expert Analysis processes.
This is just a start, you will find the complete article and learning at our Patreon community. You will find the complete post here: https://www.patreon.com/posts/158438047 plus a Wireshark lab to practice this knowledge. Thank you to our patreons for your support.
Comments and technical discussion are always welcomed from registered users below, and you are also invited to continue the conversation with the community on our Discord server. If you would like to help support the continued development of independent networking, broadband, Wi-Fi, VoIP, and packet analysis content, please consider joining our Patreon community where you will gain access to exclusive technical resources, downloadable labs and PCAPs, bonus course content, troubleshooting guides, and additional member-only material. You can also support our work by simply buying us a coffee — every contribution helps us continue creating practical, real-world network science education for professionals and enthusiasts alike.