tcp 【三次握手】【定位】

1. 定位三次握手

tcp.flags.syn == 0x02 || tcp.flags.ack == 0x02 && tcp.flags.fin != 0x02

(tcp.flags.syn == 1) or (tcp.seq == 1 && tcp.ack == 1 && tcp.len == 0 && tcp.analysis.initial_rtt)
可互换使用:
  tcp.analysis.initial_rtt 、 !(tcp.window_size_scalefactor == -1) 和 (tcp.window_size_scalefactor >= 0 or tcp.window_size_scalefactor == -2) 

https://www.modb.pro/db/199959

2. 定位没有act的tcp连接

tcp.analysis.ack_lost_segment

3. tcp建立失败

(tcp.analysis.retransmission) && (tcp.flags.syn == 1)