Ethereal-users: Re: [Ethereal-users] Finding tcp syn packets without response.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Andrew Hood <ajhood@xxxxxxxxx>
Date: Wed, 15 Jun 2005 21:32:54 +1000
Mike - wrote:
> Hello all,
>  
> Im trying to make a ethereal filter to show all tcp syn packets without
> syn-ack response from server, but I dont find the way to make this
> filter ( in not sure if its possible to make such filter). What is the
> best way to find tcp syn packets without syn-ack response?

A suitable display filter is

(tcp.flags.syn == 1) && (tcp.flags.ack == 0)

This works as a capture filter using libpcap version 0.8.3

tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn

-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who