Continued thread
#snoop on #Solaris uses the following syntax to capture TCP packets with the FIN, SYN, or RST flag set.
snoop -r -d ${INTERFACE} 'ip and tcp and (tcp[13:1]&1=1 or tcp[13:1]&2=2 or tcp[13:1]&4=4)'
Where TCP flags are in the 14th byte and:
- FIN is the 1 (LSB) bit
- SYN is the 2 bit
- RST is the 4 bit
Remember to start counting at 0, so 14th byte is byte 13.
We want one byte.
`tcp[<start>:<length>]`
The `-r` flag says not to resolve names.
The `-d` flag specifies which interface to snoop on.
In my experience, the `ip` and `tcp` keywords are needed to be able to use the `tcp[13:1]` expression.
