Here are the connection flags:
Connection Flags
+------+-------------------------------------------------------+
| Flag | Description |
+------+-------------------------------------------------------+
| U | up |
| f | inside FIN |
| F | outside FIN |
| r | inside acknowledged FIN |
| R | outside acknowledged FIN |
| s | awaiting outside SYN |
| S | awaiting inside SYN |
| M | SMTP data |
| H | HTTP get (not used) |
| I | inbound data |
| O | outbound data |
| q | SQL*Net data |
| n | nailed connection (no supported) |
| d | dump |
| P | inside back connection |
| E | outside back connection |
| G | group |
| p | replicated (unused) |
| a | awaiting outside ACK to SYN |
| A | awaiting inside ACK to SYN |
| B | initial SYN from outside |
| R | RPC |
| H | H.323 |
| D | DNS |
+--------------------------------------------------------------+
