Linux Networking Cookbook

19.8. Capturing TCP Flags with tcpdump

Problem

The syntax for tcpdump filters is pretty easy to understand, until you come to the part about filtering on specific TCP flags, like SYN, ACK, RST, and so forth. Then, it goes all bizarre. How do you know what to use?

Solution

The tcpdump manpage tells how to calculate the correct values for TCP flags. You are welcome to study it and learn how to figure them out from scratch. Or, you can copy them from here.

Capture all SYN packets:

	# tcpdump 'tcp[13] & 2 != 0'

Capture all ACK packets:

	# tcpdump 'tcp[13] & 16 != 0'

Capture all SYN-ACK packets:

	# tcpdump 'tcp[13] = 18'

Capture all FIN packets:

	# tcpdump 'tcp[13] & 1 != 0'

Capture all URG packets:

	# tcpdump 'tcp[13] & 32 != 0'

Capture all PSH packets:

	# tcpdump 'tcp[13] & 8 != 0'

Capture all RST packets:

	# tcpdump 'tcp[13] & 4 != 0'

These may be combined with other filtering options such as ports, hosts,and networks, just like in the previous recipe.

Discussion

There are several scenarios where you'll want to look for certain TCP flags, such as when you're investigating suspicious activity, or having problems with misconfigured services sending the wrong responses. Another way to do this sort of filtering is to capture a lot of data with minimal filtering and dump it to a file with the -w switch, then examine the file in Wireshark. Then, you'll be able to filter the same set of data several different ways without having to get a new capture each time.

Using Wireshark to analyze and filter a tcpdump ...