I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions:
- First 10 packets or so of a new TCP connection (including handshake)
- Anything odd (retransmissions, duplicate ACK, etc.)
- Anything indicating a disconnection (FIN, RST, anything else)
The part I'm stuck on is the first X number of packets. Is it possible to write a PCAP filter for tcpdump (or similar tool) to do this? If so, how?