LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 03-19-2004, 10:20 PM   #1
Etruscan9
LQ Newbie
 
Registered: Mar 2004
Posts: 1

Rep: Reputation: 0
Smile tcpdump filter


Actually using tethereal but the filters are the same format. I'm try to setup a
filter that only me gives packets with syn and fin without ack flags from foreign
host. Here's what I've come up with:

tethereal -f "src host not localhost and tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and
tcp[tcpflags] & (tcp-ack) != 1"

This doesn't seem to work however, I'm getting packets captured on various
conditions other than expected condition I tried to set. Looking for a little help.

Thanks
 
Old 01-20-2012, 05:27 AM   #2
uatek
LQ Newbie
 
Registered: Jan 2012
Posts: 1

Rep: Reputation: Disabled
Consider the flag value

This post is very old, but still actual, so I am going to answer it.

The problem in the specified filter is that the expression

tcp[tcpflags] & (tcp-ack) != 1

is always true, since tcp[tcpflags] & (tcp-ack) can only be 0 or 16. This is because the value of the tcp-ack flag is 16. So, to skip the packets including ACK, the filter should be this:

src host not localhost and tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and tcp[tcpflags] & (tcp-ack) != 16

The values of the different flags are: UAPRSF
URG: 32
ACK: 16
PSH: 8
RST: 4
SYN: 2
FIN: 1

Also to do that in tcpdump you have to use the following filter expression (include the quotes):

'src host not localhost and tcp[13]&3!=0 and tcp[13]&16!=16'
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
tcpdump and snort cannot filter PPPoE packets kaito Linux - Networking 8 08-16-2009 03:25 AM
Can TCPDump filter on source IP? stefaandk Linux - General 1 08-22-2005 10:51 PM
10.1 and tcpdump pr0nd3xtr Slackware - Installation 0 03-09-2005 03:37 PM
tcpdump telestudent Linux - Software 1 03-03-2005 10:07 PM
Spam filter to external mail filter deadlock Linux - Software 1 06-16-2004 02:28 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 07:59 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration