Established connections

[wozz+argus at wookie.net]

On Fri, Aug 02, 2002 at 01:29:49PM -0400, Carter Bullard wrote:
> Hey Wozz,
>    "tcp and est and not \(fin or finack or reset\)"
> 
> you'll want to use ragator first to merge
> all the flows together and then:
> 
>    ragator -w - -r file | ra tcp and est and not \(fin or finack or
> reset\)
> 
> to pick out the open flows.
> 

Great, thanks!