Identify SYN packets without SYN/ACK

Here's the gist of an idea:

1. Use tshark reading a file (and redirecting output to a file) with something like the following:

   a. a read filter to find all the SYN frames: -R tcp.flags.syn == 1

   b. ouput fields: -T fields -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport -e tcp.flags.ack

2. With some scripting (or maybe just some clever sorting) I think you should be able to identify SYNs without SYN/ACKS.

   You'll probably also want to output the frame number field (frame.number)

   I could imagine doing two passes with tshark (the first for SYNs, the second for SYN/ACKS) so as to be able to output the address/ports in the right order in each pass so that a sort of the combined output files would work.

Another nice move might be to filter for tcp.flags.syn==1 and then go to conversation statistics. There you can sort by number of packets and those sessions with only 1 to a few packets outgoing and zero incoming are the ones not getting SYN/ACK back. Then go .csv Copy etc.

Sorry, this is not professional but I had no time to try scripting stuff ;)