Hello, in your opinion how can I filter TCP traffic SYN/ACK packets that does contain window scaling options?
Can I use !(window_size_scalefactor == -2)?
(tcp.flags.syn==1 && tcp.flags.ack==1) && !(tcp.window_size_scalefactor == -2)
Window size scaling factor: -1 (unknown, start of session not captured) Window size scaling factor: -2 (no window scaling used)
Check the Display Filter Reference for TCP fields.
tcp.options.wscale.shift is the option value in the packet.
tcp.options.wscale.multiplier is the Wirehark generated value for the multiplier.
Do you want to know if the options exists:
tcp.options.wscale.shift && tcp.flags.syn==1 && tcp.flags.ack==1
Or that it affects the window size:
(tcp.options.wscale.shift > 0) && tcp.flags.syn==1 && tcp.flags.ack==1
Asked: 2022-03-18 23:40:44 +0000
Seen: 409 times
Last updated: Mar 19 '22
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
Is Window Scale Kind 3? Can I filter TCP traffic SYN/ACK packets that does contain window scaling options this way?
tcp.option_kind == 3 && tcp.flags.syn==1 && tcp.flags.ack==1
dfilter: Add bitwise masking of bits
When complete, you could streamline the flag check into
tcp.flags & 0x012 == 0x012.I'm not sure that's easier to read but more compact.
@Chuckc
tcp.flags&18==18is even more compact! ;-) I'm looking forward to this filter functionality in the next (major) release!