0

Is there a way in wireshark to find out a single SYN that does not get answered by SYN/ACK?

Improve this question

1 Answer 1

Reset to default
3

According to https://osqa-ask.wireshark.org/questions/60995/how-do-i-filter-tcp-connection-with-syn-and-syn-ack-without-ack-response/ you can do this by applying a filter (tcp.flags==0x12) and not tcp.analysis.initial_rtt. The first part finds SYN packets, and the second part find packets for which the return trip time analysis hasn't happened - which implies that Wireshark hasn't seen a corresponding ACK. Obviously, this will also find SYN packets which were ACKed after you stopped the capture, so use a long capture.

Edit This filter was too narrow, it should be:

tcp.flags.syn==1  and not tcp.analysis.initial_rtt
Improve this answer
2
  • should it instead be (tcp.flags==0x02) and not tcp.analysis.initial_rtt ?
    – fsociety
    Commented Nov 20, 2023 at 6:17
  • You are right, at least partially: if you want all SYN packets you need a broader filter. Edited the answer.
    – Paul
    Commented Nov 20, 2023 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.