How to capture ack or syn packets by Tcpdump?

Question

I want to know the filter rule , thanks!

Answer 1

The pcap filter syntax used for tcpdump should work exactly the same way on wireshark capture filter.

With tcpdump I would use a filter like this.

tcpdump "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0"

Check out the tcpdump man page, and pay close attention to the tcpflags.

Be sure to also check out the sections in the Wireshark Wiki about capture and display filters. Unfortunately the two types of filters use a completely different syntax, and different names for the same thing.

If you wanted a display filter instead of capture filter you would probably need to build an expression combining tcp.flags.ack, and tcp.flags.syn. I am far more familiar with capture filters though, so you'll have to work that out on your own.

• http://wiki.wireshark.org/DisplayFilters
  • Display filter ref: http://www.wireshark.org/docs/dfref/
  • TCP display ref: http://www.wireshark.org/docs/dfref/t/tcp.html
• http://wiki.wireshark.org/CaptureFilters

Answer 2

I made a script to see the top "synners". For that, I consider only the initial syn packet (the first packet of the three packets handshake). That is, syn = 1, ack = 0

while :; do
  date; 
  tcpdump -i eth1 -n -c 100 \
  'tcp[tcpflags] & (tcp-syn) != 0' and 
  'tcp[tcpflags] & (tcp-ack) == 0' 2> /dev/null \
  | awk '{ print $3}' \
  | sort | uniq -c | sort | tail -5;
  echo;
  sleep 1
done

Answer 3

it should show them without any filers or arguments.