there is no existing conversation with the same 5-tuple, so this is the first packet of a new conversation detected in the trace.

UDP and TCP are the most common protocols the tuple is available for, while you can’t build it for ICMP packets – simply because ICMP does not use ports, so you’d be stuck with a “3-tuple” 😉 Tracking TCP Conversation behaviorĪfter the 5-tuple for a TCP conversation was determined, there’s two possible ways to continue (reduced to a very simple process in reality the process is much more complex in its details):

The same IP and port combination with IP protocol 17 would indicate a UDP conversation.

It does that by constructing the so-called “Five-Tuple” (or 5-tuple) from the packet it currently looks at, which contains the source IP, source port, destination IP, destination port, and the layer 4 protocol. The first thing that has to happen when Wireshark crunches through a ton of packets is to determine which protocol and conversation each packet belongs to.

Tcp wireshark capture