I want to know the filter rule , thanks!
The pcap filter syntax used for tcpdump should work exactly the same way on wireshark capture filter.
With tcpdump I would use a filter like this.
tcpdump "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0"
Check out the tcpdump man page, and pay close attention to the tcpflags.
Be sure to also check out the sections in the Wireshark Wiki about capture and display filters. Unfortunately the two types of filters use a completely different syntax, and different names for the same thing.
If you wanted a display filter instead of capture filter you would probably need to build an expression combining tcp.flags.ack, and tcp.flags.syn. I am far more familiar with capture filters though, so you’ll have to work that out on your own.
Leave a comment
- Cron expression that runs every 5 minutes from 1:30 am – 6:00 am [duplicate]
- Understanding redundant power supplies
- Is there a way for administrators to disable users from installing Firefox extensions?
- Is there research material on NTP accuracy available?
- How to create a limited “domain admin” that does not have access to domain controllers?