freebsd security - May 2004 - Confirming my understanding of an ipf log line

Hi list,
I saw this in my ipf.log (using ipfmon):


18/05/2004 15:57:21.092537 fxp0 @25:1 S w.x.y.z -> a.b.c.d PR tcp len 20 
(40) frag 20@8 IN

where :
- fpx0 is my interface connected to the outside world
- w.x.y.z is an IP not related to any system under our control
- a.b.c.d is the public IP used for NATed traffic from our LAN.
- @25:1 is : @1 block in log quick from any to any with short group 25


Does the "S" after @25:1 mean it was a packet too short to be true?

What does the frag 20@8 mean?

Thanks!!
Beto

On Tue, May 18, 2004 at 04:44:25PM +1000, Norberto Meijome
wrote:
> 
> Does the "S" after @25:1 mean it was a packet too short to be
true?
> 
> What does the frag 20@8 mean?
guys, please, recently the list tends to turn into a security help list
once again...

everyone please bear in mind that freebsd-security is not intended for
general help, even if the question is somehow related to security.
for those unsure about what to post and what not, see the list charter:

http://lists.freebsd.org/mailman/listinfo/freebsd-security

cheers, t.


disclaimer:
  - Norbert, I don't take this personal, it is nothing but coincidence
    that I replied to your mail and not to any other of the recent
    off-topic mails.
  - Everyone else: I am not officially responsible for freebsd-security,
    so feel free to flame me or start another discussion on what
    freebsd-security is for. I will not reply.