Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] Way to easily identify TCP SYNs without a response?

From: "Small, James" <JSmall@xxxxxxxxxxxx>
Date: Tue, 11 Sep 2007 12:17:06 -0400
Hello,

Is there a way to easily identify TCP SYN packets that get no reply?  In
other words, no SYN/ACK or RST/ACK sent in reply?

I know you can do a tcp.flags.syn==1 and just look through the list, but
I was wondering if there is a better way with a capture/display filter?

Thanks,
  --Jim