How to check TCP connection in Wireshark?

To check TCP connections in Wireshark, you can use display filters to isolate specific TCP packets, such as SYN packets, and analyze the communication flow.

Here's a breakdown of how to check TCP connections using Wireshark:

Filtering for TCP SYN Packets

1. Apply a display filter: In Wireshark, apply the filter tcp.flags.syn == 1. This filter shows only TCP SYN packets, which are the first step in establishing a TCP connection (the three-way handshake).

2. Limit to Display Filter: According to the reference, click on "limit to display filter". This will ensure you are only seeing the TCP SYN packets in your capture.

3. Analyze the SYN Packets: Examine the source and destination IP addresses and ports to understand which machines are initiating connections and where they are connecting to. For example, the reference mentions a machine with the IP address 10.0.0.182 sending a SYN packet to another IP address on port 443.

Understanding the TCP Handshake

A typical TCP connection involves a three-way handshake:

1. SYN (Synchronization): The client sends a SYN packet to the server to initiate a connection.
2. SYN-ACK (Synchronization-Acknowledgment): The server responds with a SYN-ACK packet to acknowledge the client's SYN and to synchronize its own sequence numbers.
3. ACK (Acknowledgment): The client sends an ACK packet to the server to acknowledge the server's SYN-ACK, completing the connection establishment.

By filtering and examining these packets, you can effectively monitor and troubleshoot TCP connections in Wireshark.