I am using tcpdump to capture traffic from specific IP address.
Is there the possibility to capture new connections only, meaning TCP streams that start with SYN packet?
asked Aug 24, 2016 at 6:53
-
Unfortunately not. tcpdump just captures packets as they arrive, it does not maintain any kind of session information to differentiate between TCP streams. You would need to analyse the capture in Wireshark if you want to separate streams (you can order by stream number for example).– Mark RiddellAug 24, 2016 at 6:57
-
Be carefull, SYN bit is set in the two first packets of the TCP 3-Way Handshake. So, this filter will match all the new attempts to establish connections, not just the newly established connections. If somehow (software rule) the connection is not accepted it will also be shown.– AngelDec 2, 2017 at 8:36
Add a comment
|
2 Answers
To capture only TCP SYN packets:
# tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) != 0"
-
3That will not capture all traffic for a new session. It will only capture SYN packets. Aug 25, 2016 at 2:26
The following will capture both TCP-SYN and SYN-ACK packets.
tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) !=0"
The following will only capture TCP-SYN packets.
tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) !=0 and tcp[tcpflags] & (tcp-ack) =0"
The reason is, SYN-ACK packets include both the SYN and ACK flags. The first filter only looked for the presence of a SYN flag.
If you want to filter on inbound only, add the -Q in option.
tcpdump -i <interface> -Q in "tcp[tcpflags] & (tcp-syn) !=0 and tcp[tcpflags] & (tcp-ack) =0"
