This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all,

We are interested in developing a baseline for our network traffic between sites. This will be used to create port-based ACLs on the routers.

In order to reduce the size of our captures, we are planning to use a capture filter to look for SYN packets. However, ideally the end-game is to have a list of ports for each site and therefore we only need ONE SYN packet for each IP address/port pair. I can massage the data after the capture, but I'm wondering if anyone has any advice of clever and easy ways to do this in Wireshark.

Thanks, - Steve

asked 30 Sep '10, 12:12

RSteveKadish's gravatar image

RSteveKadish
6113
accept rate: 0%


This is something that Wireshark can't do, but fortunately, tshark can. Tshark is part of the CLI tools that are installed too when you install Wireshark.

You can use the following:

tshark -nlr <capture-file> -R "tcp.flags.syn==1 && tcp.flags.ack==0" -T fields -e ip.dst -e tcp.dstport | sort | uniq

If you also would like to know from which IP's the traffic is coming from, you can use:

tshark -nlr <capture-file> -R "tcp.flags.syn==1 && tcp.flags.ack==0" -T fields -e ip.src -e ip.dst -e tcp.dstport | sort | uniq

And if you are interested in how often sessions are set up, just add "-c" at the end. If you would like to have a top 10 of destination host/ports, you can use:

tshark -nlr <capture-file> -R "tcp.flags.syn==1 && tcp.flags.ack==0" -T fields -e ip.dst -e tcp.dstport | sort | uniq -c | sort -rn | head

(if you use windows, these commands can be used within a cygwin shell, have a look at http://www.cygwin.com)

permanent link

answered 30 Sep '10, 12:54

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Hi Sake,

Thanks very much! This is great info.

I already have a capture running with the tcp[0xd]&18=2 filter (because there simply isn't going to be enough disk space for a full capture.) So I assume that I should use the tshark syntaxes you provided and just leave out the -R option?

Thanks, - Steve

(30 Sep '10, 13:00) RSteveKadish

Sure thing, if the tracefile only contains the SYN-packets, it's not needed to filter for SYN-packets again :-)

(30 Sep '10, 13:03) SYN-bit ♦♦

Hi Sake,

I wanted to let you know that I played around with these commands (after a week of capturing) and they are extremely helpful. They will save me a lot of work by not having to massage the data manually.

Best, - Steve

(08 Oct '10, 07:32) RSteveKadish

Glad this worked for you! And thanks for the feedback :-)

(08 Oct '10, 10:50) SYN-bit ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×55

question asked: 30 Sep '10, 12:12

question was seen: 21,414 times

last updated: 08 Oct '10, 10:50

p​o​w​e​r​e​d by O​S​Q​A