| Offset| Reserved |R|C|S|S|Y|I| Window | Now let us look at the TCP Header to examine where these flags exist, also taken from RFC 793. SYN/ACK – Server response to SYN, reflecting a listening portĪCK – Acknowledge data, flag should be set on every packet afer the init SYN We can see 2 flags being sent along with sequence and acknowledgement numbers to establish the connection, namely, SYN and ACK.

TCP A TCP Bīasic 3-Way Handshake for Connection Synchronization

Below is Figure 7 from RFC 793, Transmission Control Protocol. To start, let’s explore one of the most famous interview questions, at least at the junior positions in tech, the tcp 3-way handshake. To get to where we need to I will need to introduce a few things before we get our hands dirty using filters in tcpdump. What better way to grasp the material than attempt to explain it! Strap in! Instead, we should be able to narrow our search and extract a smaller subset of data in tcpdump before we open it up in Wireshark. The instructor seems to really fancy utilizing tcpdump filters over looking things over in Wireshark so I might as well buckle down and do as my instructor once more! Furthermore, as I’ve experienced in person and discussed in this class, attempting to open a very large pcap in Wireshark is most likely not to go well.

In day 1 a lot of things could either be done with Wireshark or tcpdump but in day 2 there is a bigger emphasis in getting the most out of tcpdump.

Now that I’m on to day 2 materials of my SANS SEC503 course I find myself getting deep into tcpdump. For example, when I went through Kirk Byers free network automation course he used Vim exclusively which meant I got to get pretty comfortable with it myself. When learning, I often try to do as my teacher.

Sans wireshark filters