Home / server / Questions / 798745
In Process
Ania Katzenelson
Asked: 2016-08-24 22:53:20 +0800 CST

tcpdump capture new connections only

  • 772

I am using tcpdump to capture traffic from specific IP address. Is there the possibility to capture new connections only, meaning TCP streams that start with SYN packet?

tcpdump tcp syn

2 Answers

  1. To capture only TCP SYN packets:

    # tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) != 0"
    • 9

  2. The following will capture both TCP-SYN and SYN-ACK packets.

    tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) !=0"

    The following will only capture TCP-SYN packets.

    tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) !=0 and tcp[tcpflags] & (tcp-ack) =0"

    The reason is, SYN-ACK packets include both the SYN and ACK flags. The first filter only looked for the presence of a SYN flag.

    If you want to filter on inbound only, add the -Q in option.

    tcpdump -i <interface> -Q in "tcp[tcpflags] & (tcp-syn) !=0 and tcp[tcpflags] & (tcp-ack) =0"
    • 3