Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a pcap filter for TCPDump that will allow be to filter zero window messages?

I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I need to work with easily crashes wireshark (at least the 32 bit version) and breaking up the file and going through those captures is tedious.

Is there anyway to have a capture filter for TCP Zero Window Messages?

share|improve this question
up vote 7 down vote accepted

I think it can be done using a filter like:

"tcp[14] = 0 && tcp[15] = 0"

The tcp[i] notation means the index i of TCP header. The window size is located after 14 bytes from TCP header. For more info, you can look at man pcap-filter.

share|improve this answer
You can also match both bytes directly: tcp[14:2] = 0. – Gerald Combs Feb 21 '11 at 1:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.