Hi All,

I eventually sometimes watch most initial tcp connection attempts like this:

tcpdump -nn -Z somepcapuser not src host (12x.x5.109.xxx or 62.75.160.xxx ) and not (port 9001 or 443 or 8080 ) and tcp[tcpflags]&(tcp-syn) !=0 and not tcp[tcpflags]& (tcp-ack) !=0 or icmp

this works pretty well to quickly identify oddness so far. However, I now have a question on the following output:

03:53:52.227884 IP 203.81.166.20.53786 > 62.75.160.xxx.80: S 846930886:846930886(0) win 61690 "<"mss 1460,nop,nop,sackOK,opt-178:f04700000000,nop,wscale 4">"

I wonder what the marked portion means, haven't seen that before.

Thanks for help wlaus