I would like to match the first packet in a session after the connection has been established. So, I'm not interested in the first syn, the syn,ack and only the next ack if it is carrying data. I'm trying to inspect the first host header in an http session but I am not interested in any of the packets that follow. Any suggestions on how to accomplish this? thanks. pete -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html