Wireshark · Wireshark-users: Re: [Wireshark-users] SYN Capture Filter issue

[j.snelders@xxxxxxxxxx]

Hi Chuck Bland,

Does this capture filter do the job?
tcp[13:1]==2

Regards
Joan

On Tue, 17 Feb 2009 12:35:00 -0500 Bland Chuck-CNGR85 wrote:
>WS Version 1.0.5 (SVN Rev 26954)
>
>Capture Filter: "tcp[13] & 0x02 = 2" (no quotes)
>
>Attached: small capture file
> <<SYN Filter Test.pcap>> 
>I get mostly SYN packets, but I also get more than a few DCERPC and
>TELNET packets that do not have the SYN flag set.
>
>When I examine each datagram, the TCP Flag field is always in the same
>place. In the case of the DCERPC and TELNET packets, the flag value is
>0x18, so it should fail the filter test.
>
>Is there an explanation or is this a bug in the filter?
>
>Chuck Bland
>
>
>
>Bijlage: SYN Filter Test.pcap
>
>___________________________________________________________________________
>Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>Archives:    http://www.wireshark.org/lists/wireshark-users
>Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe