# $NetBSD: example.6,v 1.1.1.1 1999/12/11 22:24:11 veego Exp $
#
# block all TCP packets with only the SYN flag set (this is the first
# packet sent to establish a connection) out of the SYN-ACK pair.
block in proto tcp from any to any flags S/SA