Home / server / Questions / 237888
Accepted
Kyle Brandt
Asked: 2011-02-21 09:13:33 +0800 CST

tcpdump filter for tcp zero window messages

  • 772

Is there a pcap filter for TCPDump that will allow be to filter zero window messages?

I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I need to work with easily crashes wireshark (at least the 32 bit version) and breaking up the file and going through those captures is tedious.

Is there anyway to have a capture filter for TCP Zero Window Messages?

networking tcpdump pcap tcp wireshark

1 Answers

  1. Best Answer

    I think it can be done using a filter like:

    "tcp[14] = 0 && tcp[15] = 0"

    The tcp[i] notation means the index i of TCP header. The window size is located after 14 bytes from TCP header. For more info, you can look at man pcap-filter.

    • 7