Tcpdump patterns

From TykWiki
Revision as of 02:32, 2 August 2009 by Tykling (talk | contribs)
Jump to navigationJump to search

On http://danielmiessler.com/study/tcpdump_recipes/ I found this nice list:

Show me all URG packets:
# tcpdump 'tcp[13] & 32 != 0'

Show me all ACK packets:
# tcpdump 'tcp[13] & 16 != 0'

Show me all PSH packets:
# tcpdump 'tcp[13] & 8 != 0'

Show me all RST packets:
# tcpdump 'tcp[13] & 4 != 0'

Show me all SYN packets:
# tcpdump 'tcp[13] & 2 != 0'

Show me all FIN packets:
# tcpdump 'tcp[13] & 1 != 0'

Show me all SYN-ACK packets:
# tcpdump 'tcp[13] = 18'


To show incoming nsupdate queries run the following:

tcpdump port 53 and 'udp[10] = 0x28'

Also see this page for much more on bit matching with tcpdump.