Hello Tyson,

Thanks for the explanation

So, if i have to match only the initial SYN packets at the start of a TCP
session the match has to be

*match field tcp control-bit eq 2 mask 0x00*

If i have to match FIN packets ( FIN or FIN,ACK ) then the match has to be

*match field tcp control-bits eq 1 mask 0x10*

If i have to match just the ACK packets , the clause has to be
*
*
*match field tcp control-bits eq 16 mask 0x00*

Please correct me if i've not understood this correctly.

Thanks and cheers!
TacACK
_______________________________________________
For more information regarding industry leading CCIE Lab training, please visit 
www.ipexpert.com

Reply via email to