Is there a way in wireshark to find out a single SYN that does not get answered by SYN/ACK?

1 Answer 1


According to https://osqa-ask.wireshark.org/questions/60995/how-do-i-filter-tcp-connection-with-syn-and-syn-ack-without-ack-response/ you can do this by applying a filter (tcp.flags==0x12) and not tcp.analysis.initial_rtt. The first part finds SYN packets, and the second part find packets for which the return trip time analysis hasn't happened - which implies that Wireshark hasn't seen a corresponding ACK. Obviously, this will also find SYN packets which were ACKed after you stopped the capture, so use a long capture.

Edit This filter was too narrow, it should be:

tcp.flags.syn==1  and not tcp.analysis.initial_rtt
  • should it instead be (tcp.flags==0x02) and not tcp.analysis.initial_rtt ?
    – fsociety
    Nov 20 at 6:17
  • You are right, at least partially: if you want all SYN packets you need a broader filter. Edited the answer.
    – Paul
    Nov 20 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.