抓取TCP RST报文

tcpdump -w file.pcap 'tcp[tcpflags]&(tcp-rst) != 0'

tcpdump -w file.pcap 'tcp[13]&4 != 0'