First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

TCP traffic SYN/ACK packets that contain window scaling options

Hello, in your opinion how can I filter TCP traffic SYN/ACK packets that does contain window scaling options?

Can I use !(window_size_scalefactor == -2)?

(tcp.flags.syn==1 && tcp.flags.ack==1) && !(tcp.window_size_scalefactor == -2)

Window size scaling factor: -1 (unknown, start of session not captured) Window size scaling factor: -2 (no window scaling used)

tlm's avatar
3
tlm
asked 2022-03-18 23:40:44 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Is Window Scale Kind 3? Can I filter TCP traffic SYN/ACK packets that does contain window scaling options this way?

tcp.option_kind == 3 && tcp.flags.syn==1 && tcp.flags.ack==1

tlm's avatar tlm (2022-03-18 23:52:59 +0000) edit
more
  • delete

dfilter: Add bitwise masking of bits
When complete, you could streamline the flag check into tcp.flags & 0x012 == 0x012.
I'm not sure that's easier to read but more compact.

Chuckc's avatar Chuckc (2022-03-22 00:44:00 +0000) edit
more
  • delete

@Chuckc tcp.flags&18==18 is even more compact! ;-) I'm looking forward to this filter functionality in the next (major) release!

SYN-bit's avatar SYN-bit (2022-03-24 07:18:40 +0000) edit
more
  • delete
add a comment see more comments

1 Answer

0

Check the Display Filter Reference for TCP fields.

tcp.options.wscale.shift is the option value in the packet.
tcp.options.wscale.multiplier is the Wirehark generated value for the multiplier.

Do you want to know if the options exists:

tcp.options.wscale.shift && tcp.flags.syn==1 && tcp.flags.ack==1

Or that it affects the window size:

(tcp.options.wscale.shift > 0) && tcp.flags.syn==1 && tcp.flags.ack==1
Chuckc's avatar
3k
Chuckc
answered 2022-03-19 00:50:18 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Chuckc, I wanted know if the options exists. Thank you for confirming that.

tlm's avatar tlm (2022-03-19 02:00:21 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer