this seem wrong to anyone else?

flags is a 3-bit field

this represents DF as value of 4 instead of 2

yes, that looks wrong. and the line below looks wrong, too, as the offset is a 13-bit field

yes that too

danmcd: (I'm guessing if anyone would know this offhand it might be you).. is there a way to get the TCP stats (retransmits, dup acks, etc) for a _single_ tcp session?

just doing a netstat is going to be rather noisy, and not practical to eliminate the other traffic on the system

(well either system)

jbk: connstat?

oh duh

thanks

i totally forgot about that

I forget about it pretty often myself, but it's a useful one.

Between -F and -o to specify fields I think you can narrow it down pretty well.

also, just in case it's errors you are searching out, it's sometime useful to use the dtrace mib provider because netstat doesn't report all errors

but no easy way to do that by conn as far as I know

connstat should be a good starting point