tcpdump flag 필터링

By 때찌때찌맴매 - 11월 27, 2017

tcpdump flag 필터링

To capture only TCP SYN packets:

# tcpdump -i <interface> "tcp[tcpflags] & (tcp-syn) != 0"

To capture only TCP ACK packets:

# tcpdump -i <interface> "tcp[tcpflags] & (tcp-ack) != 0"

To capture only TCP FIN packets:

# tcpdump -i <interface> "tcp[tcpflags] & (tcp-fin) != 0"

To capture only TCP SYN or ACK packets:

# tcpdump -r <interface> "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0"

HoguInside & ㅁ ㅇ ㄷ nail