What does the display filter tcp.analysis.ack_rtt indicate?

• A. It shows the RTT estimate derived from ACK timings for a TCP connection.
• B. It shows the actual measured RTT for the first segment only.
• C. It shows the RTT for DNS queries.
• D. It shows the replay timing for UDP packets.

Answer: (A)

RTT in TCP is inferred from the timing of ACKs. When a data segment is sent, the time until its ACK arrives is a sample of the round‑trip time, and Wireshark uses these samples to build a smoothed RTT estimate that drives the retransmission timer. The display filter tcp.analysis.ack_rtt shows those RTT estimates derived from ACK timings for a TCP connection. It’s not about DNS queries, UDP timing, or the RTT of just the first segment; it specifically reflects the RTT information gathered from ACKs within the TCP stream.