Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to use a filter rule to capture only ack or syn packets. How do I do this?

share|improve this question
    
Personally I would not do this. I'd capture all packets, then filter on SYN and ACK flags later. If you're troubleshooting TCP, you almost always want to see a whole conversation, not just a handshake or ACK. If you're not interested in the actual data payload, you can limit packet size with tcpdump -s SIZE. The TCP header can be a variable length, so capturing -s 128 will probably get all possible headers and maybe a little bit of data. –  suprjami Dec 7 at 1:02

6 Answers 6

up vote 26 down vote accepted

The pcap filter syntax used for tcpdump should work exactly the same way on wireshark capture filter.

With tcpdump I would use a filter like this.

tcpdump "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0"

Check out the tcpdump man page, and pay close attention to the tcpflags.

Be sure to also check out the sections in the Wireshark Wiki about capture and display filters. Unfortunately the two types of filters use a completely different syntax, and different names for the same thing.

If you wanted a display filter instead of capture filter you would probably need to build an expression combining tcp.flags.ack, and tcp.flags.syn. I am far more familiar with capture filters though, so you'll have to work that out on your own.

share|improve this answer
1  
I like your response better. It looks like you went to an effort. Upvote for you. –  Ablue Dec 31 '10 at 6:43
1  
This is a great answer with good references, but please note that this syntax will capture any packets that have the SYN or ACK flags set, even if other flags are also set. This may or may not be what the OP intended. Please see my answer below for a more strict filter if only TCP SYN or ACK packets are desired. Cheers. –  JJC Aug 9 '12 at 0:33

I made a script to see the top "synners". For that, I consider only the initial syn packet (the first packet of the three packets handshake). That is, syn = 1, ack = 0

while :; do
  date; 
  tcpdump -i eth1 -n -c 100 \
  'tcp[tcpflags] & (tcp-syn) != 0' and 
  'tcp[tcpflags] & (tcp-ack) == 0' 2> /dev/null \
  | awk '{ print $3}' \
  | sort | uniq -c | sort | tail -5;
  echo;
  sleep 1
done
share|improve this answer
3  
That's a nice example. You can simplify your tcpdump capture filter even further by replacing "'tcp[tcpflags] & (tcp-syn) != 0' and 'tcp[tcpflags] & (tcp-ack) == 0'" with just 'tcp[tcpflags] == tcp-syn'. That will automatically exclude packets with ACK set. Cheers! –  JJC Aug 9 '12 at 0:36

While @Zoredache's answer is nice and complete, note that that syntax will yield any packets that have the TCP SYN or the TCP ACK flag set, including packets which are not strictly just plain "TCP SYN" or "TCP ACK" packets, because they also have other flags set. This may or may not be what you (or future readers) intended. For example, that syntax will also capture TCP SYN-ACK packets, TCP FIN-ACK, etc. If you want only TCP SYN or TCP ACK packets (i.e. JUST one of those flags set), the proper capture filter syntax is:

'tcp[tcpflags] == tcp-syn or tcp[tcpflags] == tcp-ack'

Equivalently:

'tcp[13] == 2 or tcp[13] == 16'

Cheers!

share|improve this answer

I wanted to get only SYN packets myself, I used the following command:

tcpdump -i eth7 'tcp[13] & 2 != 0'

This should work for you straightaway.

share|improve this answer
    
This will capture any packets with the SYN flag set, including SYN, SYN-ACK, etc. If you want only SYN packets, use 'tcp[13] == 2' instead. Cheers! –  JJC Aug 9 '12 at 0:34

tcpdump 'tcp[13] = 3'

http://danielmiessler.com/study/tcpdump/

Advanced

You can also filter based on specific portions of a packet, as well as combine multiple conditions into groups. The former is useful when looking for only SYNs or RSTs, for example, and the latter for even more advanced traffic isolation.

UAP RSF

[ Hint: An anagram for the TCP flags: Unskilled Attackers Pester Real Security Folk ]

your memo: ...

Show me all URGENT (URG) packets...

tcpdump 'tcp[13] & 32!=0'

Show me all ACKNOWLEDGE (ACK) packets...

tcpdump 'tcp[13] & 16!=0'

Show me all PUSH (PSH) packets...

tcpdump 'tcp[13] & 8!=0'

Show me all RESET (RST) packets...

tcpdump 'tcp[13] & 4!=0'

Show me all SYNCHRONIZE (SYN) packets...

tcpdump 'tcp[13] & 2!=0'

Show me all FINISH (FIN) packets...

tcpdump 'tcp[13] & 1!=0'

Show me all SYNCHRONIZE/ACKNOWLEDGE (SYNACK) packets...

tcpdump 'tcp[13]=18'

[ Note: Only the PSH, RST, SYN, and FIN flags are displayed in tcpdump's flag field output. URGs and ACKs are displayed, but they are shown elsewhere in the output rather than in the flags field ]

share|improve this answer
1  
Plagarism isn't allows on Stack Exchange. Please edit this post to make it clear that you have copied the content from the linked site. Thank you. –  Chris S May 17 '13 at 19:59

it should show them without any filters or arguments.

share|improve this answer
    
Your answer is technically correct, but the OP probably meant to include the word "only" in his question. ;-) Cheers! –  JJC Aug 9 '12 at 0:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.