I want to use a filter rule to capture only ack or syn packets. How do I do this?
The pcap filter syntax used for tcpdump should work exactly the same way on wireshark capture filter.
With tcpdump I would use a filter like this.
Check out the tcpdump man page, and pay close attention to the tcpflags.
Be sure to also check out the sections in the Wireshark Wiki about capture and display filters. Unfortunately the two types of filters use a completely different syntax, and different names for the same thing.
If you wanted a display filter instead of capture filter you would probably need to build an expression combining tcp.flags.ack, and tcp.flags.syn. I am far more familiar with capture filters though, so you'll have to work that out on your own.
I made a script to see the top "synners". For that, I consider only the initial syn packet (the first packet of the three packets handshake). That is, syn = 1, ack = 0
I wanted to get only SYN packets myself, I used the following command:
This should work for you straightaway.
While @Zoredache's answer is nice and complete, note that that syntax will yield any packets that have the TCP SYN or the TCP ACK flag set, including packets which are not strictly just plain "TCP SYN" or "TCP ACK" packets, because they also have other flags set. This may or may not be what you (or future readers) intended. For example, that syntax will also capture TCP SYN-ACK packets, TCP FIN-ACK, etc. If you want only TCP SYN or TCP ACK packets (i.e. JUST one of those flags set), the proper capture filter syntax is:
You can also filter based on specific portions of a packet, as well as combine multiple conditions into groups. The former is useful when looking for only
[ Hint: An anagram for the TCP flags: Unskilled Attackers Pester Real Security Folk ]
your memo: ...
Show me all URGENT (
Show me all ACKNOWLEDGE (
Show me all PUSH (
Show me all RESET (
Show me all SYNCHRONIZE (
Show me all FINISH (
Show me all SYNCHRONIZE/ACKNOWLEDGE (
[Note: Only the