As like TCP SACK, TCP timestamp is a TCP option that will be included in the SYN and SYN/ACK segments. When the TCP endpoints are enabled with RTT measurement feature, the endpoints signal the capability of including TCP timestamp to peer by in SYN packet. When both the endpoints support this feature, the sender will include the TCP timestamp option in all the segments forwarded to peer.

As seen in the preceding example, the TCP timestamp option will be seen in SYN and SYN/ACK segments. If this TCP option is not seen in the capture, ensure that the feature is enabled on the TCP endpoints. Depending on the vendor and platform, this feature may be enabled by default.

As shown in the preceding screenshot, the sender will include the local time in TSval field while sending the segment out. The sender will include a zero value in timestamp echo reply (TSecr).

The receiver should include TSecr only in the Ack packet. As shown in the preceding example, the receiver is replying with TSecr and TSval included. The sender will use the combination of these two to derive the RTT value. More details about the feature are available in How it works... section.