Ask Your Question

Revision history [back]

Find asymmetric streams (tcp.stream with client but no server packets)

hi, i have a pcap with overall 2402 streams in it, and i can see that lots of them seem to be 'asymmetric' ('analyze / follow tcp stream' shows a number of client packets, but 0 server packets for them).

Can someone give me a hint how a filter expression for this kind of somewhat crippled connections could look like (e.g. something like 'tcp.stream==asymmetric' or similar)?

Thx in advance...