TCPDump syntax to packet capture only initial TCP 3-way handshak

Google is your friend here. tcpdump is a standard Unix/Linux utility. So a quick google will reveal (Among Others)

How to capture TCP SYN, ACK and FIN packets with tcpdump

And form there...

To capture only TCP SYN packets:

 tcpdump -i  "tcp[tcpflags] & (tcp-syn) != 0"
To capture only TCP ACK packets:

 tcpdump -i  "tcp[tcpflags] & (tcp-ack) != 0"
To capture only TCP FIN packets:

 tcpdump -i  "tcp[tcpflags] & (tcp-fin) != 0"
To capture only TCP SYN or ACK packets:

 tcpdump -i  "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0"

So your syntax would be something like...

tcpdump -i 0.0 -nn -p -e "host 192.168.1.18 and port 8000 and tcp[tcpflags] & (tcp-syn|tcp-ack) != 0"

H