Wireshark-users: [Wireshark-users] how to get ACK only in handshake
From: "Chong Zhang" <[email protected]>
Date: Wed, 11 Jun 2008 15:37:13 -0400
Hi all,

I am trying to use twireshark/tcpdump to get only the TCP 3way
handshake packets. There are two tapped interfaces, one for each
direction, so the SYN- ACK and ACK packets are on different
interfaces. I am wondering if there is way to only capture the ACK
belonging to a handshake, rather than all ACK packets for the whole
session.

TIA,
CZ