How can I figure out if a packet is a TCP Keep-Alive?

Question

Wireshark and Network Monitor provide filters for this but I want to know how can I infer whether a packet is a TCP Keep-Alive or Keep-Alive Ack by looking at the header or payload.

Answer 1

Here's what Wireshark says about a keep-alive ACK:

Set when all of the following are true:

• The segment size is zero.
• The window size is non-zero and hasn’t changed.
• The current sequence number is the same as the next expected sequence number. -The current acknowledgement number is the same as the last-seen acknowledgement number.
• The most recently seen packet in the reverse direction was a keepalive.
• The packet is not a SYN, FIN, or RST.