First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

How to filter TCP SYN that has their bits set to 1?

I'm trying to understand how to use filters, how would I filter to find TCP SYN with their bits set to 1?

tada234's avatar
5
tada234
asked 2019-10-15 00:49:06 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

You didn't specifically say display filters but will assume you're working with an existing capture.

Either of these will show frames with the SYN bit set:

tcp.flags.syn==1

or

tcp.flags & 0x02

If you want to exclude SYN/ACK frames and only show SYN use this:

tcp.flags.syn==1 && tcp.flags.ack==0
Chuckc's avatar
3k
Chuckc
answered 2019-10-15 02:05:08 +0000, updated 2019-10-15 02:05:43 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer