Getting started with Linux: How to Use tcpdump to capture tcp syn, ACK, and FIN packets

Getting started with Linux: How to Use tcpdump to capture tcp syn, ACK, and FIN packets

Q: I want to monitor TCP connection activities (for example, three handshakes for establishing a connection and four handshakes for disconnecting ). To accomplish this, I only need to capture TCP control packets, such as SYN, ACK, or FIN flag related packets. How can I use tcpdump to capture only TCP SYN, ACK, and/or FYN packets?

As an industry-standard capture tool, tcpdump provides powerful and Flexible packet filtering functions. The libpcap packet capture engine, based on tcpdump, supports standard packet filtering rules, such as filtering based on a 5-packet header (such as source/destination IP address/port and IP protocol type ).

Linux network has two very useful commands: ip address and TcpDump

Use TcpDump in Linux

Linux TcpDump command details

Linux TcpDump packet capture Analysis

Usage and Use Cases of Tcpdump

Linux O & M engineers: Nmap and TCPdump

The packet filtering rules of tcpdump/libpcap also support more common grouping expressions. In these expressions, any byte range in the package can be checked using relational or binary operators. For byte range expressions, you can use the following format:

1. Proto [expr: size]

"Proto" can be one of the well-known protocols (such as ip, arp, tcp, udp, icmp, ipv6). "expr" indicates the byte offset associated with the beginning of the specified protocol header. There are well-known direct offsets such as tcpflags and value constants such as tcp-syn, tcp-ack or tcp-fin. "Size" is optional, indicating the number of bytes checked from the byte offset.

In this format, you can filter tcp syn, ACK, or FIN packets as follows.

Capture only tcp syn packets:

1. # Tcpdump-I <interface> "tcp [tcpflags] & (tcp-syn )! = 0"

Capture only tcp ack packets:

1. # Tcpdump-I <interface> "tcp [tcpflags] & (tcp-ack )! = 0"

Capture only tcp fin packets:

1. # Tcpdump-I <interface> "tcp [tcpflags] & (tcp-fin )! = 0"

To capture tcp syn or ACK packets:

1. # Tcpdump-r <interface> "tcp [tcpflags] & (tcp-syn | tcp-ack )! = 0"

This article permanently updates the link address: