Revision history  [back]

Unfortunately, there's currently no filter to check for that (unlike, for example, checking for the time between the initial SYN and the SYN+ACK response).

You could try

tcp.analysis.ack_rtt > .5

to find all packets with an ACK that's more than .5 seconds (500 ms) after the packet being ACKed.