Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I listen internal network interface of router on freebsd, I get outputs like this

10:36:02.372026 IP > Flags [.], ack 1097, win 65050, length 0
10:36:02.374275 IP > NTPv4, Server, length 48
10:36:02.376121 IP bad-len 0

My purpose is that filter out to "bad-len 0" packets with tcpdump itself (not grep etc.) I tried to write "greater 0" filter options but it didn't work.

share|improve this question

You can use this expression to filter ip packets with zero in ip length header feild:

tcpdump -petnvv -i em0 'ip[2:2] = 0'

See pcap-filter(4) for tcpdump expression syntax and RFC 791 or other resources, e. g. this for ip header structure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.