Which TCP reserved bit? ECN? The reserved fields in the ack?
Or failing that, setup some other way to capture packets (does iOS do reverse tethering? or you can setup a different wifi access point and capture packets between that and the firewall, etc)