Wireshark filters

TCP 3-way handshake

Show entire handshake

tcp.flags.syn == 1 || tcp.flags.ack == 1

Capture first SYN packet

tcp.flags.ack == 0

Filter by TCP destination port

tshark -Y "tcp.dstport == <port>"

Filter by SYN+ACK flags

tshark -Y "(tcp.flags & 0x12) == 0x12"