Filter TCP SYN scan from pcap file?

Hello,

I want to filter only the SYN packets from TCP SYN scan (both for open ports(SYN->SYN/ACK->RST) and closed ports(SYN->RST/ACK)) from a pcap file.

I have written a following script to do the same and it seems working for me.

for stream in `tshark -nr  capture.pcap -Y "(ip.dst==192.68.167.00/24 && tcp.seq==1 && tcp.flags.reset==1 && tcp.flags.ack==0)||(tcp.flags.reset==1 && tcp.flags.ack==1 && tcp.ack==1)" -T fields -e tcp.stream | sort -n | uniq`

do
  tshark -r capture.pcap -w ./portscans/stream_$stream.pcap -Y "ip.dst==192.68.167.00/24 && tcp.seq==0 && tcp.flags.syn==1 && tcp.flags.ack==0 && tcp.stream eq $stream"
done

But the above script is taking hell out of time to run it.. It is taking more than a day to filter out packets from a 150MB pcap file.

Can someone suggest me any other method to do the same(with tshark or snort)?

asked 17 Feb '17, 04:35

subinjp
41●7●7●13
accept rate: 0%

edited 17 Feb '17, 04:42

grahamb ♦
19.8k●3●30●206

One Answer:

active answers oldest answers newest answers popular answers

For starters you could see if you can apply the 'in' operator to tcp.stream, to get an expression like 'tcp.stream in { n m ...}', where n and m are stream numbers collected before. Although that would give you one single output file, so you may have to split that up afterwards.

permanent link

answered 17 Feb '17, 08:08

Jaap ♦
11.7k●16●101
accept rate: 14%

@jaap Thanks for your reply. In fact I dont want to split packets in to different files. But I did not get what do you mean by it? Could you write the script below or describe it little more?

(17 Feb '17, 08:17) subinjp

Your answer

toggle preview

community wiki:

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Question tags:

tshark ×832
pcap ×238
syn ×55
port-scanning ×4
snort ×4

question asked: 17 Feb '17, 04:35

question was seen: 1,430 times

last updated: 17 Feb '17, 08:17

Filter TCP SYN scan from pcap file?

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions