tcpdump filter for tcp zero window messages

Question

Is there a pcap filter for TCPDump that will allow be to filter zero window messages?

I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I need to work with easily crashes wireshark (at least the 32 bit version) and breaking up the file and going through those captures is tedious.

Is there anyway to have a capture filter for TCP Zero Window Messages?

Answer 1

I think it can be done using a filter like:

"tcp[14] = 0 && tcp[15] = 0"

The tcp[i] notation means the index i of TCP header. The window size is located after 14 bytes from TCP header. For more info, you can look at man pcap-filter.