Hi All,

I was trying to capture Syn-Ack packets using this tcpdump filter, but its not working. Its showing syn packets only.

I am wondering if this is a wrong filter for syn-ack packets

[root@server ~]# tcpdump 'tcp[13] == 18' -c 25

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
13:31:17.188227 IP source-server.com.5666 > destination-server.com.48904: S 2422690267:2422690267(0) ack 840023909 win 5792 <mss 1460,sackOK,timestamp 692368222 37103231,nop,wscale 7>
13:31:24.230014 IP source-server.com.5666 > destination-server.com.48964: S 2758407005:2758407005(0) ack 2155881030 win 5792 <mss 1460,sackOK,timestamp 692375264 37110272,nop,wscale 7>



Krishna

URG
tcpdump 'tcp[13] & 32!=0'
ACK
tcpdump 'tcp[13] & 16!=0'
PSH
tcpdump 'tcp[13] & 8!=0'
RST
tcpdump 'tcp[13] & 4!=0'
SYN
tcpdump 'tcp[13] & 2!=0'
FIN
tcpdump 'tcp[13] & 1!=0'
SYNACK
tcpdump 'tcp[13]=18'