Wireshark · Wireshark-users: [Wireshark-users] how to get ACK only in handshake

["Chong Zhang" <chongz.zhang@xxxxxxxxx>]

Hi all,

I am trying to use twireshark/tcpdump to get only the TCP 3way
handshake packets. There are two tapped interfaces, one for each
direction, so the SYN- ACK and ACK packets are on different
interfaces. I am wondering if there is way to only capture the ACK
belonging to a handshake, rather than all ACK packets for the whole
session.

TIA,
CZ