Using tcpdump to only capture SYN and FIN packets

Sometimes with a network capture, all you want to know is when a session starts and when it finishes. So you don't actually want to capture anything beyond the session start and finish handshakes. Here's how to do it:

tcpdump -w flagdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'