Which session flag indicates that it is to/from the local stack?

The session flag that indicates traffic is to or from the local stack is "local." This flag is specifically used to signify that the traffic is handled by the local processing stack of a device rather than being sent to or coming from an external network interface.

When a session is marked with the "local" flag, it means that the traffic does not require forwarding to another interface or device; instead, it is processed internally. This is particularly relevant in scenarios where local services or resources are being accessed. Understanding this flag is crucial for network engineers because it helps in monitoring and troubleshooting session states and traffic flow, especially when analyzing how resources on the local device communicate with one another.

Other flags, such as "br" (bridge), "npu" (Network Processing Unit), and "wccp" (Web Cache Communication Protocol) serve different purposes and are used for other types of processing or communication roles, but they do not specifically indicate traffic to or from the local stack.