Filtering by TCP Header

• First packet opening connection has ACK bit unset, later ones have it set
• Block inward TCP calls by discarding packets with ACK bit unset and external IP source
• All later packets from same source are discarded by recipient as garbage because there was no start packet