<r-cellspan="1-8"data-tooltiptitle="16 bits<br>Port segment was sent from"class="ethernet-frame-cell">
<pclass="frame-text">Source port</p>
</r-cell>
<r-cellspan="9-16"data-tooltiptitle="16 bits<br>Port segmnent is sent to"class="ethernet-frame-cell">
<pclass="frame-text">Destination port</p>
</r-cell>
</r-grid>
<r-gridcolumns="1"class="ethernet-frame-grid">
<r-cellspan="row"data-tooltiptitle="32 bits<br>If SYN flag is set, this is the initial packet.<br>If SYN is not set, data is at number+1"class="ethernet-frame-cell">
<pclass="frame-text">Sequence number</p>
</r-cell>
</r-grid>
<r-gridcolumns="1"class="ethernet-frame-grid">
<r-cellspan="row"data-tooltiptitle="32 bits<br>If the ACK flag is set,<br>then the value of this field is the next<br>sequence number that the sender of the ACK is expecting."class="ethernet-frame-cell">
<pclass="frame-text">Acknowledgment number</p>
</r-cell>
</r-grid>
<r-gridcolumns="16"class="ethernet-frame-grid">
<r-cellspan="1-2"data-tooltiptitle="4 bits<br>Number of 32 bit words that define the size of the header."class="ethernet-frame-cell">
<pclass="frame-text">Data offset</p>
</r-cell>
<r-cellspan="3-4"data-tooltiptitle="3 bits<br>Reserved for future use."class="ethernet-frame-cell">
<pclass="frame-text">Reserved</p>
</r-cell>
<r-cellspan="5-9"data-tooltiptitle="9 bits<br>SYN: synchronize, start of connection<br>ACK: acknowledge, confirm connection<br>RST: reset connection<br>FIN: last package from sender<br>URG: urgent bit is significant<br>CWR: congestion window reduced"class="ethernet-frame-cell">
<pclass="frame-text">Flags</p>
</r-cell>
<r-cellspan="10-16"data-tooltiptitle="16 bits<br>Number of bytes the sender of this segment is willing to receive"class="ethernet-frame-cell">
<pclass="frame-text">Window size</p>
</r-cell>
</r-grid>
<r-gridcolumns="2"class="ethernet-frame-grid">
<r-cellspan="1"data-tooltiptitle="16 bits<br>Used for error checking. TCP can resend invalid segments."class="ethernet-frame-cell">
<pclass="frame-text">Checksum</p>
</r-cell>
<r-cellspan="1"data-tooltiptitle="16 bits<br>If the URG flag is set, then this 16-bit field is an offset from the sequence number indicating the last urgent data byte."class="ethernet-frame-cell">
<pclass="frame-text">Urgent pointer</p>
</r-cell>
</r-grid>
<r-gridcolumns="1"class="ethernet-frame-grid">
<r-cellspan="row"data-tooltiptitle="0-320 bits<br>Optional options. Must be divisable by 32, otherwise 0 padding at the end."class="ethernet-frame-cell">
<pclass="frame-text">Options</p>
</r-cell>
</r-grid>
</r-cell><!-- TCP Header -->
<r-cellclass="panel">
<h2>UDP Header</h2>
<r-gridcolumns="2"class="ethernet-frame-grid">
<r-cellspan="1"data-tooltiptitle="16 bits<br>Port the datagram is sent from (optional in IPv6)."class="ethernet-frame-cell">
<pclass="frame-text">Source Port</p>
</r-cell>
<r-cellspan="1"data-tooltiptitle="16 bits<br>Port the datagram is sent to."class="ethernet-frame-cell">
<r-cellspan="1"data-tooltiptitle="16 bits<br>Used for error recognition. Optional in V4, mandatatory in V6. All zeroes if unused."class="ethernet-frame-cell">
<r-cellspan="1"data-tooltiptitle="tcpdump -n -c10 -i eth0 tcp">udp</r-cell><r-cellspan="2-5">Capture udp, also works with others such as arp</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i eth0 host 10.10.10.10 and [not] udp">host IP</r-cell><r-cellspan="7-10">Capture data to or from this host only</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -n -c10 -i eth0 src 10.10.10.10 and tcp">src IP</r-cell><r-cellspan="2-5">Capture data from this host only</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i eth0 dst 10.10.10.10">dst IP</r-cell><r-cellspan="7-10">Capture data sent to this host only</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -n -c10 -i eth0 net 10.10.10.0/24">net CIDR</r-cell><r-cellspan="2-5">Capture data to or from this subnet</r-cell>
<r-cellspan="6-6"data-tooltiptitle="tcpdump -n -c10 -i eth0 host 10.10.10.10 and port 53">port number</r-cell><r-cellspan="7-10">Use service name instead of port</r-cell>
<r-cellspan="1"data-tooltiptitle="tcpdump -n -i eth0 port not ssh">port not num|name</r-cell><r-cellspan="2-5">Exclude port or service in report</r-cell>
<r-cellspan="1"data-tooltiptitle="iptables -I INPUT -m mac --mac-source 00:00:00:FF:FF:FF">-m extension</r-cell><r-cellspan="2-5">Use an extension to match packet</r-cell>
<r-cellspan="1"data-tooltiptitle="iptables -L [-t tablename]">-L</r-cell><r-cellspan="7-10">List all rules, use -t for specific tables</r-cell>
<r-cellspan="row"><h3>chains</h3></r-cell>
<r-cellspan="row">A chain defines a set of rules. They do not need either a source nor a destination. They can be applied to those later.</r-cell>
<r-celldata-tooltiptitle="Sent in this context means,<br>directly sent via the interface<br>this rule applies to"span="1-2">OUTPUT - When a package is sent</r-cell>
<r-cellspan="3-4">INPUT - When a package is received</r-cell>
<r-celldata-tooltiptitle="Example: Using another virtual interface<br>for e.g. a virtual machine."span="5-6">FORWARD - When a package is forwarded</r-cell>
<r-cellspan="7-10">USER DEFINED - You can define a user defined chain and apply it to any source/destination.</r-cell>
</r-grid>
</r-cell>
<r-cell>
<r-gridcolumns="10"class="panel">
<r-cellspan="row"><h2>Fibre cables color coding</h2></r-cell>
