CODEWITHSUNDEEP
tcpwiresharklibpcaptcpdumpsnort
tremendows
tremendows

Reputation: 4382

Is it possible to not include retransmitted packets from a libpcap capture?

My objective is to obtain in a unique capture the sendt tcp packets from a source host, NOT including the retransmitted packets. Is it possible to not include in the packet the retransmitted packets? I'm using libpcap but any help with wireshark/tshark/snort could be useful (because they use libpcap library)

Upvotes: 0

Views: 468

Answers (1)

Nicholas Blasgen
Nicholas Blasgen

Reputation: 862

From Wiresharks Documentation try the following:

 not tcp.analysis.duplicate_ack and not tcp.analysis.retransmission

Upvotes: 1

Related Questions