Use the and operand to get the second nibble of flags

This was clearly a typo and fails to detect connection requests when using randomized addresses.