SYNフラグのたったパケット(★1,★2)採取をおこなう。 [root@node1 ~]# tcpdump -i eth0 '(tcp[tcpflags] & tcp-syn)' != 0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 11:53:15.864640 IP master.48604 > node1.http: Flags ★1[S], seq 1922717478, win 29200, options [mss 1460,sackOK,TS val 10235908 ecr 0,nop,wscale 7], length 0