Skip to content

Instantly share code, notes, and snippets.

@arsperger

arsperger/wireshark101_tcp_syn_without_synack.md

Created April 13, 2021 05:58
Show Gist options
  • Save arsperger/4d1076af937f8454f292f6a069deddec to your computer and use it in GitHub Desktop.
Save arsperger/4d1076af937f8454f292f6a069deddec to your computer and use it in GitHub Desktop.
Download ZIP
Wireshark tcp connection timeout (SYN/SYNACK)
Raw
wireshark101_tcp_syn_without_synack.md

Wireshark find SYN w/o SYNACK

  • set display filter 'tcp.flags eq 0x02' (only SYN flag set)
  • open Statistics -> Conversations
  • Select the option "Limit to display filter"
  • Select the tab TCP
  • Sort the output by "Packets".

Those connections with 1 packet are likely the "good" connections (one SYN only)

Those connections with > 1 packets are most likely the unanswered connections (several packets with SYN as a result of a retry).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment