Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Packets that I want to see (just samples, there are thousands of them):

314 2.280146	192.168.0.1	192.168.0.2	TCP	ah-esp-encap > 11188 [PSH, ACK] Seq=1 Ack=1 Win=65535 Len=121
316 2.290003	192.168.0.2	192.168.0.1	TCP	11188 > ah-esp-encap [PSH, ACK] Seq=1 Ack=122 Win=5840 Len=98

Packets that I want to be filtered out:

311 2.279182	192.168.0.1	192.168.0.2	TCP	ah-esp-encap > 11188 [SYN] Seq=0 Win=65535 Len=0 MSS=1460
312 2.279404	192.168.0.2	192.168.0.1	TCP	11188 > ah-esp-encap [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460
312 2.279404	192.168.0.2	192.168.0.1	TCP	11188 > ah-esp-encap [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460
312 2.279404	192.168.0.2	192.168.0.1	TCP	11188 > ah-esp-encap [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460

How to write that filter? I think the main difference between them is that I want only the PSH packets, and I want to exclude the SYN packets. I looked at the reference but I don't understand it yet.

share|improve this question
add comment

1 Answer

I found the answer:

tcp.flags.push == 1
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.