Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2022-03-18 05:15:07 +0000

BigFatCat gravatar image

tcp.option_kind == 8 is the TCP time stamp option.

tcp.option_kind == 8 && tcp.flags.syn==1 will show all the syn and syn/ack packets with time stamp option.

tcp.option_kind == 8 && tcp.flags.syn==1 && tcp.flags.ack==0 will show only syn packets with time stamp option.

tcp.option_kind == 8 && tcp.flags.syn==1 && tcp.flags.ack==1 will show only syn/ack packets with time stamp option

tcp.option_kind == 8 will show any packet with the time stamp option