Only recieve win=65535 info packets

Question

I only want to display packets which have win=65535 in the info, how to do this as filter?

Answer 1

1	You can use the filter: `tcp.window_size == 65535` You can always look in the packet details for a field with it's value and then use (rightclick) Apply as filter to achieve this in an easy way :-) link answered 16 Jun '12, 04:33 SYN-bit ♦♦ 12.3k●8●42●176 accept rate: 18%

You have a trillion packets.