I am using TCPDUMP to capture traffic from specific IP address. Is there the possibility to capture new connections only, meaning TCP streams that start with SYN packet?

Thank you

  • Unfortunately not. tcpdump just captures packets as they arrive, it does not maintain any kind of session information to differentiate between TCP streams. You would need to analyse the capture in Wireshark if you want to separate streams (you can order by stream number for example). – Mark Riddell Aug 24 '16 at 6:57
  • Be carefull, SYN bit is set in the two first packets of the TCP 3-Way Handshake. So, this filter will match all the new attempts to establish connections, not just the newly established connections. If somehow (software rule) the connection is not accepted it will also be shown. – Angel Dec 2 '17 at 8:36

To capture only TCP SYN packets:

# tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) != 0"
  • 3
    That will not capture all traffic for a new session. It will only capture SYN packets. – user5870571 Aug 25 '16 at 2:26

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.