note Anonymous Monk It appears to be as follows. <code> 1 = FIN 2 = SYN 4 = RST 8 = PSH 16 = ACK 32 = URG </code> What ever number is returned from the $tcp->{'flags'} represents what packet set was seen. Ex: SYN ACK = 2 + 16 resulting in 18. 117146 117168 0