This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

How is it possible that I filter out (remove) the packets that are only TCP ACKs in a capture? I want to use it in tshark.

asked 02 Jun '15, 04:10

aby_mcs's gravatar image

aby_mcs
6113
accept rate: 0%

edited 02 Jun '15, 04:10


Yes. The filter is "tcp.flags.ack==0". But that will leave you with anything that isn't TCP plus a couple of SYN packets (if at all). Because even data packets will have the ACK flag set.

If you want to remove all packets that contain no data and just acknowledge data coming from the other side, use "tcp and not tcp.len==0", to filter away everything that isn't TCP or has no TCP payload.

permanent link

answered 02 Jun '15, 04:21

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×752
×349
×184
×61

question asked: 02 Jun '15, 04:10

question was seen: 24,594 times

last updated: 02 Jun '15, 04:21

p​o​w​e​r​e​d by O​S​Q​A