Wireshark: how to filter for a specific SYN packet

Question

I'm pretty new to wireshark and stuck with a filter task.
I have network traffic and error message from a certain system. I need to trace the syn packet of one of my error messages.

For wireshark that means that I need to filter for one specific ip-port combination x.x.x.x:xxxx among the Syn packets.

With tcp.flags.syn == 1 as display filter I have been able to narrow down to only Syn packets, but it's still far to many to find the one packet belonging to the port where we see the error and that we would like to follow.

Can you help me with that?

Answer 1

Looking only at SYN packets is not very helpful if you need to find a conversation that has problems - it's usually better to gather as much information about the IPs involved in the problem and filter on them. E.g. if you know that the computer with the IP 192.168.1.1 has a problem, and your capture has tons of conversations, you can filter on that IP by using the following filter:

ip.addr==192.168.1.1

If you also know the layer 4 protocol and port (e.g. TCP on port 1025) you can filter on both IP and port, like this:

ip.addr==192.168.1.1 and tcp.port==1025.

If you have a plain text protocol and know the text of the error message (if it is actually visible in a packet, and not just some coded thing), you could use the "find" option and search for the string (don't forget to set the search type to "string", because the default is "display filter").