How to detect TCP Connection time_taken, TCP Connection Refused, and TCP Connection Timed out with Splunk Stream?

I have several questions regarding Splunk Stream for TCP protocol: 1. How to measure time_taken for TCP Connection establishment between TCP SYN and SYN-ACK using Splunk Stream? 2. How to detect TCP Connection Refused? How to measure the time_taken for it? 3. Can we detect TCP Connection Timed Out or when the client decides to cancel the TCP Connection request? Many thanks before, Haley