#snoop on #Solaris uses the following syntax to capture TCP packets with the FIN, SYN, or RST flag set.

snoop -r -d ${INTERFACE} 'ip and tcp and (tcp[13:1]&1=1 or tcp[13:1]&2=2 or tcp[13:1]&4=4)'

Where TCP flags are in the 14th byte and:
- FIN is the 1 (LSB) bit
- SYN is the 2 bit
- RST is the 4 bit

Remember to start counting at 0, so 14th byte is byte 13.

We want one byte.

`tcp[<start>:<length>]`

The `-r` flag says not to resolve names.

The `-d` flag specifies which interface to snoop on.

In my experience, the `ip` and `tcp` keywords are needed to be able to use the `tcp[13:1]` expression.

#suntember