Wireshark · Ethereal-users: Re: [Ethereal-users] ethereal display filter tcp.flags

[Breen Mullins <bmullins@xxxxxxxxxx>]

On Tue, 2002-06-25 at 12:22, Gibson, Beth wrote:
> Folks,
> 
>   Does anyone know of a listing of the meanings of the values for the
> display filter, "tcp.flags" ? By trial and error, I figured out a few of
> them (0x04  gets you RST packets;  0x02 gets you SYN packets, etc), but I
> was wondering if there is a complete list available.  I'd like to filter for
> [PSH] and [PSH, ACK] packets .

Well, it's defined in the RFC. But you already have the information in
ethereal itself. Pick a TCP frame and expand the flags byte in the
middle pane of the display.

Cheers,

Breen

-- 
Breen Mullins
SQA Engineer 
Asante Technologies, Inc.
800-662-9686x323
<bmullins@xxxxxxxxxx>