Recall from Section 3.5 that the first segment in every TCP connection has the ACK
bit set to 0, whereas all the other segments in the connection have the ACK bit set to
1.
Filtering can also be based on whether or not the TCP ACK bit is set. This trick
is quite useful if an organization wants to let its internal clients connect to external
servers but wants to prevent external clients from connecting to internal servers.
Recall from Section 3.5 that the first segment in every TCP connection has the ACK
bit set to 0, whereas all the other segments in the connection have the ACK bit set to
1.