Wireshark 2 Quick Start Guide

Unusual TCP traffic

Lost connection or unsuccessful connection attempt scenarios are the most common forms of unusual TCP traffic. You might also observe several other scenarios, such as high latencies due to long-distance communications. To make the analysis convenient and easy to troubleshoot, use the time column by sorting it to figure out large time gaps between the packets at the top of the list pane.

Another example can be where a malicious device is running a port scan on your network and your firewall responds with RST packets to avoid such reconnaissance attacks, or it might also be possible that the port closed. Refer to the following screenshot, where I've tried scanning a node over network using nmap, and it seems quite visible ...