group by tcp stream and output the last 10 packets captured to see how a connection ended.

tshark.sh

tshark -r xyz.pcapng -Y "tcp.port != 445" -T fields -e tcp.stream -e frame.time_relative -e ip.src -e ip.dst -e _ws.col.info | sort -V | awk 'BEGIN {
    prev = 0;
    count = 0;
} {
    buffer[NR % 11] = $0; 
    if ($1 != prev) {
        for (i = NR-count; i<NR; i++)
            print buffer[i % 11];
        print "";
        prev = $1;
        count = 1
    } else {
        if (count<10)
            count++;
    }
}
END {
    for (i = NR-count; i<NR; i++)
        print buffer[i % 11];
}'