Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It is possible to count connections who do not respond with RST flag set in connection initiated ? I am interested to log IP, MAC and TTL.

share|improve this question

It should be possible using standard tools such as tcpdump.

See this reply to another question. It provides an example of processing tcpdump output in real time using a scripting language. I believe that could be extended to do what you want. Substitute your favourite scripting language.

share|improve this answer
I want to pairing in real time one-to-one syn packets (who began a connection) with ACK packets. In this way I want to know IP, MAC and TTL for syn-flood connections. Also, I want to pairing packets with ACK set incorrectly with RST packets. And I have no idea how to ... – georgian Mar 14 '12 at 7:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.