Wireshark-users: [Wireshark-users] Way to easily identify TCP SYNs without a response?

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Small, James" <JSmall@xxxxxxxxxxxx>
Date: Tue, 11 Sep 2007 12:17:06 -0400
Hello,

Is there a way to easily identify TCP SYN packets that get no reply?  In
other words, no SYN/ACK or RST/ACK sent in reply?

I know you can do a tcp.flags.syn==1 and just look through the list, but
I was wondering if there is a better way with a capture/display filter?

Thanks,
  --Jim