How to filter TCP SYN that has their bits set to 1?

tada234
5 ●2 ●2 ●3

I'm trying to understand how to use filters, how would I filter to find TCP SYN with their bits set to 1?

1 Answer

Sort by » oldest newest most voted

Chuckc
3023 ●6 ●608 ●20

You didn't specifically say display filters but will assume you're working with an existing capture.

Either of these will show frames with the SYN bit set:

tcp.flags.syn==1

tcp.flags & 0x02

If you want to exclude SYN/ACK frames and only show SYN use this:

tcp.flags.syn==1 && tcp.flags.ack==0

Please start posting anonymously - your entry will be published after you log in or create a new account.

Asked: 2019-10-15 00:49:06 +0000

Seen: 4,590 times

Last updated: Oct 15 '19