I do two things prior to executing the query below[*]: 1. ssh outbound from myhost (on the local network) to www.bogus[.]net (on the internet) 2. ssh inbound from 192.168.1[.]124 to myhost

1. ssh outbound from myhost

hostname            	family 	path 			protocol 	remote_address 									remote_port	time		type
<http://myhost.home.bogus.net|myhost.home.bogus.net>	2		/usr/bin/ssh	0			193.214.208.180									22			1642184524	524290
<http://myhost.home.bogus.net|myhost.home.bogus.net>	10		/usr/bin/ssh	0			20:01:46:10:00:1f:00:00:00:00:00:00:00:00:00:80	22			1642184524	524290
<http://myhost.home.bogus.net|myhost.home.bogus.net>	2		/usr/bin/ssh	6			193.214.208.180									22			1642184524	1

2. ssh inbound to myhost

<http://myhost.home.bogus.net|myhost.home.bogus.net>	-1		/usr/sbin/sshd	-1			192.168.1.124									61697		1642185109	-1
<http://myhost.home.bogus.net|myhost.home.bogus.net>	10		/usr/sbin/sshd	0			00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00	22			1642185109	524290
<http://myhost.home.bogus.net|myhost.home.bogus.net>	10		/usr/sbin/sshd	0			00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00	0			1642185109	524290

My questions are as follows: - what does 'type=524290' indicate? - the established session towards .180 from myhost in (1) appears to have type 1, but the established session from .124 in (2) appears to have type -1 (the IP family appears to be -1 too, for that matter); why? [*] select time,path,remote_address,remote_port,family,type,protocol from bpf_socket_events