Skip to content

Instantly share code, notes, and snippets.

@compor

compor/bash_tcpdump_capture_synack_packets.sh

Created February 25, 2013 14:45
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save compor/5030246 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save compor/5030246 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
bash_tcpdump_capture_synack_packets.sh
# capture SYN/ACK flagged packets
# tcp[13] is the byte location of TCP flags (URG,ACK,PSH,RST,SYN,FIN)
#
# mnemonic
#
# Unskilled 32
# Attackers 16
# Pester 8
# Real 4
# Security 2
# Folks 1
tcpdump -n -i eth0 'tcp[13] & 2 != 0 && tcp[13] & 16 != 0'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment