tcpdump filter for tcp zero window messages
Is there a pcap filter for TCPDump that will allow be to filter zero window messages?
I know how to filter these in a wireshark display filter (tcp.analysis.zero_window
) but the amount of data I need to work with easily crashes wireshark (at least the 32 bit version) and breaking up the file and going through those captures is tedious.
Is there anyway to have a capture filter for TCP Zero Window Messages?
I think it can be done using a filter like:
"tcp[14] = 0 && tcp[15] = 0"
The tcp[i]
notation means the index i
of TCP header. The window size is located after 14 bytes from TCP header. For more info, you can look at man pcap-filter
.