Time Stamp Options enabled
How do I Apply a filter for SYN/ ACK packets that have the Time Stamp Options enabled?
tcp.option_kind == 8 is the TCP time stamp option.
tcp.option_kind == 8 && tcp.flags.syn==1 will show all the syn and syn/ack packets with time stamp option.
tcp.option_kind == 8 && tcp.flags.syn==1 && tcp.flags.ack==0 will show only syn packets with time stamp option.
tcp.option_kind == 8 && tcp.flags.syn==1 && tcp.flags.ack==1 will show only syn/ack packets with time stamp option
tcp.option_kind == 8 will show any packet with the time stamp option
As general rule of thumb: Expand you packet. Find the field you want to filter on and use your right mouse button to add a filter. That is in general the easiest way to find good samples of filters that makes sense for your packets.
Asked: 2022-03-18 03:40:57 +0000
Seen: 238 times
Last updated: Mar 18 '22