Wednesday, January 23, 2008

Monitoring TCP connection open/close in Ethereal

I found the following filter expression to be useful when I need to monitor only the TCP connection open/close.
(tcp.flags.syn == 1 || tcp.flags.fin == 1 || tcp.flags.reset == 1)

For e.g. when you wish to monitor all the SSL connections opened and closed, the following Filter is good:
(tcp.port == 443) && (tcp.flags.syn == 1 || tcp.flags.fin == 1 || tcp.flags.reset == 1)
You can also combine the IP address of the server you are interested in, like:
(tcp.port == 443) && (tcp.flags.syn == 1 || tcp.flags.fin == 1 || tcp.flags.reset == 1) && (ip.addr == X.X.X.X)
Monitoring the connection open/close activity helps in understanding the client behavior. For e.g. generally Firefox and IE both open multiple (I have seen three or four at the max) https connections and reuse the same SSL session ID. These connections are concurrently open and most of them don't get closed from the browser side until the web server closes them.

No comments: