Is it possible to filter TCP retranmission packet in tcpdump?

Question

I am trying to see TCP retransmission packet in tcpdump.

I find commands to filter sync packet, ACK packet but could not able to find filter of retransmitted packet

Is there any command for filter such packets.

Thanks in advance.

Answer 1

I've just been using this for tracing re transmissions in wireshark:

tcp.analysis.retransmission

This also is useful:

tcp.flags.reset==1

In tcpdump, you can do resets with this expression (not tried re-transmissions yet, but if I figure that out I'll reply to my answer):

'tcp[tcpflags] & (tcp-rst) != 0'

Answer 2

When you use Wireshark or TShark you can use a display filter:
field name: tcp.analysis.retransmission

AFAIK there is no capture filter to do the trick on tcpdump, dumpcap, Wireshark or TShark.