I'm looking to capture the conversation between 2 hosts that contains the 3 way handshake. I'm not sure if this would be doable with a capture filter. Or maybe it's a display filter. I'm thinking something like: tcp.flags == 0x02 | tcp.flags == 0x10 But I don't know if this is just a display capture. It doesn't seem to be recognized in capture filter box. Or maybe the concept is to to set a display filter of tcp.flags == 0x02 | tcp.flags == 0x10 and then capture all traffic and only this syn, syn ack, or ack will be displayed.
asked 17 Oct '12, 07:08
You could try "tcp & 2!=0" as a capture filter, which worked fine when I just tested it, at least for SYN and SYN/ACK packets. The third packet (ACK) of the handshake might be a problem because you can't just filter on ack flags - it would give you all further packets because they will probably all carry an ACK flag.
I think the other filters you mentioned are all display filters.
answered 17 Oct '12, 10:49
edited 17 Oct '12, 10:51
I was able to take advantage of what you said Kurt with LUA.
I think I have it working. Maybe someone can run my LUA script to capture TCP handshake.
My command to run tshark from DOS:
where my interface number is 4. Run tshark -D to list interfaces.
answered 28 Oct ‘12, 12:28
edited 13 Jun ‘16, 06:50
to be specific: it's not possible to capture only the full 3-way handshake (SYN,SYN-ACK,ACK), as it's impossible to identify the single ACK in the handshake with tcpdump. The best you can achive is what Jasper suggested. This will capture the SYN and the SYN-ACK, however not the final ACK of the 3-way handshake.
The same holds true for Wireshark display filters. Even there it is not possible to capture/filter the final ACK of the 3-way handshake, without getting the rest of the communication (ACK flag set) as well.
You could do it with a Listener in Lua, but that would require some programming.
answered 17 Oct '12, 11:08
Kurt Knochner ♦
edited 17 Oct '12, 11:10
You can't do this with a capture filter. Make sure Wireshark is using relative sequence numbers and then enter the following display filter:
(tcp.flags.syn==1 ) || (tcp.flags == 0x0010 && tcp.seq==1 && tcp.ack==1)
Update: Further testing shows that this display filter will display what you want most of the time, but it's not perfect. It will miss the third packet of the handshake if that packet contains data and the PSH bit is set, for example. It will also display the first packet in each direction of a TCP stream whose three-way handshake is not present in the trace file.
answered 17 Oct '12, 19:34
edited 17 Oct '12, 21:14
How about this one?
((tcp.flags.syn eq 1) || (tcp.seq eq 1 && tcp.ack eq 1 && frame.protocols == "eth:ip:tcp" && !tcp.flags.fin eq 1))
Requires "Relative sequence numbers" in TCP Protocol Preferences.
answered 18 Oct '12, 06:22
I managed to come up with a pcap filter expression that captures the whole TCP setup 3-way handshake - it relies on knowing the value for window size that will be set in the 3rd packet of the handshake. For the Linux 3.8.11-ec2 kernel servers I was capturing on, this value is
The capture expression matches: any packet containing the syn flag set (first two packets of the handshake) and packets that are < 68 bytes long, have only the ack flag set and have the window size set to
The capture filter expression is therefore: "( tcp[tcpflags] & tcp-syn != 0 ) or ( tcp[tcpflags] = tcp-ack and less 68 and tcp[14:2] == 0x01c9 )"
answered 27 Feb '14, 17:36
tcp.flags==0x2 || tcp.flags==0x12 || tcp.flags==0x10 and tcp.seq<=1 and tcp.ack<=1 and not nbss
with relative sequence numbers?
answered 03 Feb '16, 05:37
Gian Matteo ...
((tcp.flags == 0x0002) && (tcp.seq == 0)) || ((tcp.flags == 0x0012) && (tcp.seq == 0)) || ((tcp.flags == 0x0010) && (tcp.seq == 1))
answered 12 Jun '16, 00:47