# Collecting port scans -- "Ignore empty non-FIN packet"

**URL:** <https://discuss.elastic.co/t/collecting-port-scans-ignore-empty-non-fin-packet/63884>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [October 25, 2016, 2:37pm UTC](https://discuss.elastic.co/t/collecting-port-scans-ignore-empty-non-fin-packet/63884 "2016-10-25T14:37:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tipene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tipene/32/12715_2.png) [@tipene](https://discuss.elastic.co/u/tipene)\
**Post date:** [October 25, 2016, 2:37pm UTC](https://discuss.elastic.co/t/collecting-port-scans-ignore-empty-non-fin-packet/63884/1 "2016-10-25T14:37:37Z")

</div>

How can I collect the opening packet in a port scan (ie, the SYN before the handshake is completed) using Packetbeat?

I'm using pcap with bpf\_filter to select all TCP/IP traffic from a variety of ports. Unfortunately this does not capture port scans. The explanation (when I ran packetbeat -d "\*" ) is that the non-FIN (ie, SYN packet) is discarded:

decoder.go:179: DBG Ignore empty non-FIN packet

When I dump to a file using the -dump argument I do see the packets listed there, however, they are not submitted to ElasticSearch because they are discarded.

This is the configuration that I'm using:

interfaces:  
device: any  
type: pcap  
snaplen: 1514  
buffer\_size\_mb: 10  
bpf\_filter: "port 23 or port 2323 or port 6789"

---

<div class="post-metadata">

**Author:** ![tipene](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tipene/32/12715_2.png) [@tipene](https://discuss.elastic.co/u/tipene)\
**Post date:** [October 25, 2016, 2:40pm UTC](https://discuss.elastic.co/t/collecting-port-scans-ignore-empty-non-fin-packet/63884/2 "2016-10-25T14:40:29Z")

</div>

Example command line:

sudo packetbeat -c packetbeat\_raw.yml -d "\*" -dump /tmp/tcp-out

Output from tcpdump:

tcpdump -r /tmp/tcp-out -n  
...  
10:25:17.978102 IP 49.143.22.136.49387 \> x.x.x.x.telnet: Flags [S], seq 758585095, win 60867, length 0  
10:25:17.995765 IP x.x.x.x.telnet \> 49.143.22.136.49387: Flags [R.], seq 0, ack 758585096, win 0, length 0

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2016, 2:37pm UTC](https://discuss.elastic.co/t/collecting-port-scans-ignore-empty-non-fin-packet/63884/3 "2016-11-15T14:37:57Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.