const struct tok tcp_flag_values[] = {
        { TH_FIN, "F" },
        { TH_SYN, "S" },
        { TH_RST, "R" },
        { TH_PUSH, "P" },
        { TH_ACK, "." },
        { TH_URG, "U" },
        { TH_ECNECHO, "E" },
        { TH_CWR, "W" },
        { TH_AE, "e" },
        { 0, NULL }
};
…
        flags = tcp_get_flags(tp);
        ND_PRINT("Flags [%s]", bittok2str_nosep(tcp_flag_values, "none", flags));

        if (!ndo->ndo_Sflag && (flags & TH_ACK)) {
…
                        if (!th->nxt || (flags & TH_SYN)) {
                                /* didn't find it or new conversation */
…
                                th->addr = tha;
                                if (rev) {
                                        th->ack = seq;
                                        th->seq = ack - 1;
                                } else {
                                        th->seq = seq;
                                        th->ack = ack - 1;
                                }
                        } else {
                                if (rev) {
                                        seq -= th->ack;
                                        ack -= th->seq;
                                } else {
                                        seq -= th->seq;
                                        ack -= th->ack;
                                }
                        }
…
        length -= hlen;
        if (ndo->ndo_vflag > 1 || length > 0 || flags & (TH_SYN | TH_FIN | TH_RST)) {
                ND_PRINT(", seq %u", seq);

                if (length > 0) {
                        ND_PRINT(":%u", seq + length);
                }
        }
Warm-up
