I'm working on a rather large .pcap file, and I'm interested in displaying only the TCP connections that contain a SYN packet. Is there any way to do this?
asked 20 Sep '10, 10:44
The display filter to show only SYN packets is:
If you only want to capture TCP/SYN packets, the capture filter would be:
When you are not only interested in the SYN packets, but also the SYN/ACK packets this changes to:
If I read your question in another way, you are looking for "all packets belonging to a TCP session for which the SYN packet is actually in the capture file". If this is your question, this can't be done directly with Wireshak. But you can do it by using MATE or LUA.
Or you can write a tshark script to extract all the TCP sessions that have the initial SYN in the capture file.
answered 20 Sep '10, 10:54
edited 20 Sep '10, 10:56
(tcp.flags.syn == 1 and tcp.flags.ack == 0) is the display filter you want
answered 20 Sep '10, 10:48
With the release of Wireshark 1.6.0, and thanks to some code changes by Sake Blok, you can now show all conversations that have their three-way handshake in the trace file with the display filter "tcp.window_size_scalefactor!=-1".
Note that this will show each CONVERSATION whose three-way handshake is present in the trace file, but it won't show the SYN packet or the SYN/ACK packet. The display will start with the third packet of the three-way handshake for each conversation. To see everything, select the stream you're interested in and then select "Follow TCP Stream."
answered 07 Jun '11, 13:51
For anyone who's curious, this bash script seems to work. I'm sure there's an easier way to do it, but I'm not the best scripter in the world.
answered 21 Sep ‘10, 10:12
If I only want to see the SYN-Flag (and not also SYN/ACK or funky flag combinations created by OS fingerprinting tools like nmap) I usually go for
I used to do it like Sake suggested with the "tcp.flags.syn==1 and tcp.flags.ack==0", but I'm lazy and since my memory now allows me to remember the shorter version with "0x02" I use that :-)
Oh, and maybe this helps: if you want to avoid loading the whole trace and then filter it, you can also use the "tcp.flags==0x02" as a load filter in the open file dialog. That will then only load the frames that match and allow faster processing afterwards.
answered 24 Sep '10, 02:52
edited 24 Sep '10, 02:55