How to see the TCP connection closing in Wireshark?

Use the filter

   "tcp.flags.fin eq 1 or tcp.flags.reset eq 1"

You should see a four way handshake, with one FIN from each side followed by an ACK from the other.

Last modified: Tuesday, 24 March 2015, 9:32 PM