1

I'm trying to capture syn packets going to a given destination port with tcpdump with the following command :

tcpdump dst port 80 "(tcp-syn) !=0"

but it says

tcp: syntax error

Any idea how to select those two filters ?

ChiseledAbs
  • 995

1 Answers1

3

There are two problems with your command:

  1. You're missing logical operator and between port and packet type
  2. tcp-syn is a constant - because of this the comparison in quotes is always true.

This should behave correctly:

tcpdump dst port 80 and "tcp[tcpflags] & tcp-syn != 0"

Marek Rost
  • 2,076
  • 10
  • 16
  • yeah I found that out thanks, can you take a look at another thread maybe you could help me http://unix.stackexchange.com/questions/298619/why-tcpdump-captures-many-packets-with-tcp-syn-0-but-not-with-tcptcpfla – ChiseledAbs Jul 27 '16 at 12:41