Wireshark-users: [Wireshark-users] how to get ACK only in handshake
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Chong Zhang" <chongz.zhang@xxxxxxxxx>
Date: Wed, 11 Jun 2008 15:37:13 -0400
Hi all,

I am trying to use twireshark/tcpdump to get only the TCP 3way
handshake packets. There are two tapped interfaces, one for each
direction, so the SYN- ACK and ACK packets are on different
interfaces. I am wondering if there is way to only capture the ACK
belonging to a handshake, rather than all ACK packets for the whole
session.

TIA,
CZ