7

Is there a pcap filter for TCPDump that will allow be to filter zero window messages?

I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I need to work with easily crashes wireshark (at least the 32 bit version) and breaking up the file and going through those captures is tedious.

Is there anyway to have a capture filter for TCP Zero Window Messages?

John Gardeniers
  • 27,458
  • 12
  • 55
  • 109
Kyle Brandt
  • 83,619
  • 74
  • 305
  • 448

1 Answers1

9

I think it can be done using a filter like:

"tcp[14] = 0 && tcp[15] = 0"

The tcp[i] notation means the index i of TCP header. The window size is located after 14 bytes from TCP header. For more info, you can look at man pcap-filter.

Khaled
  • 36,533
  • 8
  • 72
  • 99