CODEWITHSUNDEEP
tcpdump
bulkmoustache
bulkmoustache

Reputation: 2025

Filter ACK packets

I have the following tcpdump -i eth0 -w pkts.pcap -n tcp port 5000 to filter every packet flowing between 2 hosts. However, one of the hosts always sends an ACK.

How do I filter the ACKs too, so my pkts.pcap does not show them?

Upvotes: 1

Views: 2002

Answers (1)

Mike Schiffman
Mike Schiffman

Reputation: 240

tcpdump -i eth0 -w pkts.pcap -n "tcp port 5000 and tcp[tcpflags] & (tcp-ack) = 0" will result in SYN and RST packets being deposited in pkts.pcap.

Upvotes: 2

Related Questions