That is exactly correct.
Regards, Tyson Scott - CCIE #13513 R&S, Security, and SP Managing Partner / Sr. Instructor - IPexpert, Inc. Mailto: [email protected] Telephone: +1.810.326.1444, ext. 208 Live Assistance, Please visit: www.ipexpert.com/chat eFax: +1.810.454.0130 IPexpert is a premier provider of Self-Study Workbooks, Video on Demand, Audio Tools, Online Hardware Rental and Classroom Training for the Cisco CCIE (R&S, Voice, Security & Service Provider) certification(s) with training locations throughout the United States, Europe, South Asia and Australia. Be sure to visit our online communities at www.ipexpert.com/communities and our public website at www.ipexpert.com <http://www.ipexpert.com/> From: Vybhav Ramachandran [mailto:[email protected]] Sent: Tuesday, August 24, 2010 9:00 PM To: Tyson Scott Cc: Bruno; OSL Security Subject: Re: [OSL | CCIE_Security] "mask" keyword in FPM Hello Tyson, Thanks for the explanation So, if i have to match only the initial SYN packets at the start of a TCP session the match has to be match field tcp control-bit eq 2 mask 0x00 If i have to match FIN packets ( FIN or FIN,ACK ) then the match has to be match field tcp control-bits eq 1 mask 0x10 If i have to match just the ACK packets , the clause has to be match field tcp control-bits eq 16 mask 0x00 Please correct me if i've not understood this correctly. Thanks and cheers! TacACK
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
