How to create a filter to remove TCP sessions with no payload

Question

Hi all,

I haven't found a good way to do this yet. Is there a way to filter out TCP sessions that have no payload? (Basically, sessions that have the 3-way handshake and then immediately close via FIN or RST that didn't actually transmit any meaningful data).

Thanks

-VK

Answer 1

Unfortunately, display filters work on individual packets, and have no state, so there's no simple display filter to do that. I don't know enough about MATE to say whether it would support that.

Answer 2

You could use tshark to create that filter for you :-)

To find all TCP packets with data, use:

tshark -r <file> -R "tcp.len>0"

... we're only interested in the ID's of the TCP sessions that contain data:

tshark -r <file> -R "tcp.len>0" -T fields -e tcp.stream

Then use some shell magic to create a list of all these session ID's:

tshark -r <file> -R "tcp.len>0" -T fields -e tcp.stream |\
    sort -n | uniq

... and transform it into a display filter:

tshark -r <file> -R "tcp.len>0" -T fields -e tcp.stream |\
    sort -n | uniq |\
    awk '{printf("%stcp.stream==%d",sep,$1);sep="||"}'

You can then use that filter in Wireshark. Or you can create a new tracefile with only the sessions containing data in one run with:

tshark -r <file> - w <newfile> -R $(\
    tshark -r <file> -R "tcp.len>0" -T fields -e tcp.stream |\
        sort -n | uniq |\
        awk '{printf("%stcp.stream==%d",sep,$1);sep="||"}'\
)

Hope this helps!