Wireshark · Ethereal-users: Re: [Ethereal-users] Finding tcp syn packets without response.

[Andrew Hood <ajhood@xxxxxxxxx>]

Mike - wrote:
> Hello all,
>  
> Im trying to make a ethereal filter to show all tcp syn packets without
> syn-ack response from server, but I dont find the way to make this
> filter ( in not sure if its possible to make such filter). What is the
> best way to find tcp syn packets without syn-ack response?

A suitable display filter is

(tcp.flags.syn == 1) && (tcp.flags.ack == 0)

This works as a capture filter using libpcap version 0.8.3

tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn

-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who