Understood..many thx for all the help.. By the way, do you know if there's a way to distinguish between the ACK packet sent during the connection establishment phase of a TCP connection and subsequent ACK packets sent during the data transfer phase. I now that the ACK number sent during the connection establishment will be equal to the 'sequence number for the SYN in the SYN/ACK packet' + 1 Is there a way to distinguish between this 3rd packet and any other ACK packet during data transfer w/o having to keep track of sequence numbers? Are there other characteristics or options that are set in the former and not in the latter? Basically I want to capture the three packets sent during the connection establishment phase of TCP. How can I do that? Warm regards, Visham _______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
