Home/ Questions/Q 7752573
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-01T11:50:04+00:00

I have been trying to filter tcpdump output based on packets lengths. But I

  • 0

I have been trying to filter tcpdump output based on packets lengths. But I had no luck.

This is the simple output for a command;

tcpdump -n -i eth0 dst port 443 -A

17:03:30.866890 IP 192.168.0.149.45104 > 62.75.148.60.443: Flags [S], seq 2685064927, win 14600, options [mss 1460,sackOK,TS val 7028787 ecr 0,nop,wscale 4], length 0
E..<..@.@.......>K.<.0...
........9............
.k@3........


17:03:30.867658 IP 192.168.0.149.45104 > 62.75.148.60.443: Flags [.], ack 2285019097, win 913, options [nop,nop,TS val 7028787 ecr 974439509], length 0
E..4..@.@.......>K.<.0...
...2.............
.k@3:..U


17:03:30.867928 IP 192.168.0.149.45104 > 62.75.148.60.443: Flags [P.], seq 0:171, ack 1, win 913, options [nop,nop,TS val 7028787 ecr 974439509], length 171
E.....@.@..f....>K.<.0...
...2.............
.k@3:..U...........Opw2.....l..".T.7.q.]h..8W..%.....H...
.......9.8.......5...   .....E.D.3.2...........A...../.........
...1.........alice.sni.velox.ch.
.................#..


17:03:30.869712 IP 192.168.0.149.45104 > 62.75.148.60.443: Flags [.], ack 1319, win 1078, options [nop,nop,TS val 7028788 ecr 974439511], length 0
E..4..@.@.......>K.<.0...
...2.....6.......
.k@4:..W


17:03:30.870724 IP 192.168.0.149.45104 > 62.75.148.60.443: Flags [P.], seq 171:178, ack 1319, win 1078, options [nop,nop,TS val 7028788 ecr 974439511], length 7
E..;..@.@.......>K.<.0...
...2.....6.......
.k@4:..W......0

I want to see packages only if they have more then 100bytes length. for this case, only the 3rd packet.

options [nop,nop,TS val 7028787 ecr 974439509], length 171

I have looked at man pages for tcpdump, but couldn’t find any useful parameter. there is an expression ‘greater length’ mentioned here; http://www.ethereal.com/docs/man-pages/tcpdump.8.html but i couldn’t use that expression too. 

$ tcpdump -n -i eth0 dst port 443 -A -x greater 100
tcpdump: syntax error

Thank’s for any help.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    greater length works, but you have to use it as part of a complete filter expression, and the filter expression has to come after all the command-line flag arguments.

    Working example:

    tcpdump -n -i eth0 -A -x dst port 443 and greater 100

    Should work – dst port 443 and greater 100 is a complete filter expression, which checks for packets that are being sent to TCP or UDP port 443 and that have a total length (including link-layer, IP, and TCP headers!) greater than 100.

    NOT working example:

    tcpdump -n -i eth0 dst port 443 -A -x greater 100

    Will not work – the dst in dst port 443 is treated as the beginning of a filter expression, meaning that it and everything after it, including -A and -x, are treated as part of the filter expression, but -A and -x are not valid components of a filter expression. They are presumably intended to be command-line options, so they must go before all non-flag arguments, including the components of the filter expression.

    • 0