Currently, the behavior is only to log the originating and destination
addresses, the sequence numbers, the ack, the win, and what TCP flags
were set, etc, etc. Which leaves us 30 or 46 people who could have
caused the rule to log.
Am I overlooking some marvelous little feature of the packet filter
logging rules? (If not, this would be a remarkably welcome enhancement).
"Didn't know I needed it until I did." :)
-Dave