Hey, i wrote a filter using libnetfilter_queue api, and i want to send messages to the queue in a specific way... I want to get the first packet after the TCP 3-way-handshak is finished ( meaning - only data!).. i tried using conntrack with "ESTABLISHED" status, but then i start getting messages to the queue from the last message of the handshake... ( meaning the last ack )... and i dont want that since it contain no data.... any help will be appreciated.. thanks. Yechiel Levi -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html