Combine the two filters with a logical OR: That filter will find the SYN packets - to also find SYN-ACK packets, a second filter is needed: = 1 & = 1. Finding the SYN and SYN-ACK packets of each TCP conversation being initiated is pretty simple to do in Wireshark by applying a post-capture filter like = 1 & = 0. We can start to identify the full TCP conversations by looking for the 3-way handshakes. For TCP-based applications, we filter out just the full TCP conversations.

To do this we want to feed it traffic from only the application we're interested in. When testing new applications that can be identified by FlowView, we give it an initial, best chance at succeeding to do so. These packet captures are typically recorded without filtering, so naturally they will contain extraneous protocols and many mid-conversation sessions that happened to be in progress at capture start time. The packet captures can be homemade by us or from our customers. When verifying that FlowView is identifying flows with the correct application, we use tcpreplay to send traffic from packet capture files into an appliance capture interface.

Tcp wireshark capture