Wireshark · Wireshark-users: Re: [Wireshark-users] SYN Capture Filter issue

["Bland Chuck-CNGR85" <Chuck.Bland@xxxxxxxxxxxx>]

Guy,

Thanks for your interest and time.

Chuck

D:\Profiles\cngr85\Desktop\dump>windump -h
windump version 3.9.5, based on tcpdump version 3.9.5
WinPcap version 4.0.2 (packet.dll version 4.0.0.1040), based on libpcap
version 0.9.5
Usage: windump [-aAdDeflLnNOpqRStuUvxX] [ -B size ] [-c count] [ -C
file_size ]
                [ -E algo:secret ] [ -F file ] [ -i interface ] [ -M
secret ]
                [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
                [ -W filecount ] [ -y datalinktype ] [ -Z user ]
                [ expression ]

D:\Profiles\cngr85\Desktop\dump>windump -d "tcp[13] & 0x02 = 2"
windump: listening on \Device\NPF_GenericDialupAdapter
(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 11
(002) ldb      [23]
(003) jeq      #0x6             jt 4    jf 11
(004) ldh      [20]
(005) jset     #0x1fff          jt 11   jf 6
(006) ldxb     4*([14]&0xf)
(007) ldb      [x + 27]
(008) and      #0x2
(009) jeq      #0x2             jt 10   jf 11
(010) ret      #96
(011) ret      #0

D:\Profiles\cngr85\Desktop\dump>windump -d "tcp[13:1] = 2"
windump: listening on \Device\NPF_GenericDialupAdapter
(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 10
(002) ldb      [23]
(003) jeq      #0x6             jt 4    jf 10
(004) ldh      [20]
(005) jset     #0x1fff          jt 10   jf 6
(006) ldxb     4*([14]&0xf)
(007) ldb      [x + 27]
(008) jeq      #0x2             jt 9    jf 10
(009) ret      #96
(010) ret      #0