// stays unchanged in the anonymized version
		cmdLineWithoutPools := re.ReplaceAllString(cmdLine, `$1$2`)

		// to be anonymized
		poolsArgs := re.ReplaceAllString(cmdLine, `$3`)
		var anonPools []string

		if !strings.Contains(poolsArgs, "{") || !strings.Contains(poolsArgs, "}") {
			// No ellipses pattern. Anonymize host name from every pool arg
			pools := strings.Fields(poolsArgs)

    /**
     * Context flag for sequence checking capability
     */
    public static final int SEQUENCE_CHECKING = 0x10;
    /**
     * Context flag for anonymity capability
     */
    public static final int ANONYMITY = 0x08;
    /**
     * Context flag for confidentiality (encryption) capability
     */
    public static final int CONFIDENTIALITY = 0x04;
    /**

    }

    @Test
    @DisplayName("Context flags encode as DER BIT STRING and parse back")
    void testContextFlagsRoundTripViaAsn1() throws Exception {
        int flags = NegTokenInit.ANONYMITY | NegTokenInit.CONFIDENTIALITY | NegTokenInit.SEQUENCE_CHECKING;
        byte[] token = buildInitToken(new ASN1ObjectIdentifier[] { OID_KRB }, flags, null, null, false, null, null, null);

        if (this.gssContext.getSequenceDetState()) {
            contextFlags |= NegTokenInit.SEQUENCE_CHECKING;
        }
        if (this.gssContext.getAnonymityState()) {
            contextFlags |= NegTokenInit.ANONYMITY;
        }
        if (this.gssContext.getConfState()) {
            contextFlags |= NegTokenInit.CONFIDENTIALITY;
        }
        if (this.gssContext.getIntegState()) {

        int flags = ctx.getFlags();
        int expected = NegTokenInit.DELEGATION | NegTokenInit.MUTUAL_AUTHENTICATION | NegTokenInit.REPLAY_DETECTION
                | NegTokenInit.SEQUENCE_CHECKING | NegTokenInit.ANONYMITY | NegTokenInit.CONFIDENTIALITY | NegTokenInit.INTEGRITY;
        assertEquals(expected, flags);
    }

    @Test
    @DisplayName("isEstablished reflects underlying context state")