root@imap-test:~# tcpdump -n -i eth0 host 172.16.0.13
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:36:00.886811 ARP, Request who-has 172.16.0.13 tell 172.16.0.66, length 28
09:36:00.888071 ARP, Reply 172.16.0.13 is-at 00:50:56:b5:81:76, length 46
09:36:00.888088 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [S], seq 2509538212, win 14600, options [mss 1460,sackOK,TS val 41913867 ecr 0,nop,wscale 2], length 0
09:36:00.888456 IP 172.16.0.13.143 > 172.16.0.66.35641: Flags [S.], seq 703703456, ack 2509538213, win 14480, options [mss 1460,sackOK,TS val 3304080992 ecr 41913867,nop,wscale 7], length 0
09:36:00.888493 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [.], ack 1, win 3650, options [nop,nop,TS val 41913867 ecr 3304080992], length 0
09:36:00.889084 IP 172.16.0.13.143 > 172.16.0.66.35641: Flags [P.], seq 1:19, ack 1, win 114, options [nop,nop,TS val 3304080993 ecr 41913867], length 18
09:36:00.889107 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [.], ack 19, win 3650, options [nop,nop,TS val 41913867 ecr 3304080993], length 0
09:36:00.889372 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [P.], seq 1:13, ack 19, win 3650, options [nop,nop,TS val 41913867 ecr 3304080993], length 12
09:36:00.889716 IP 172.16.0.13.143 > 172.16.0.66.35641: Flags [.], ack 13, win 114, options [nop,nop,TS val 3304080993 ecr 41913867], length 0
09:36:00.889805 IP 172.16.0.13.143 > 172.16.0.66.35641: Flags [P.], seq 19:35, ack 13, win 114, options [nop,nop,TS val 3304080993 ecr 41913867], length 16
09:36:00.890583 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [P.], seq 13:239, ack 35, win 3650, options [nop,nop,TS val 41913868 ecr 3304080993], length 226
09:36:00.896904 IP 172.16.0.13.143 > 172.16.0.66.35641: Flags [P.], seq 35:2546, ack 239, win 122, options [nop,nop,TS val 3304081000 ecr 41913868], length 2511
09:36:00.896929 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [.], ack 2546, win 4374, options [nop,nop,TS val 41913869 ecr 3304081000], length 0
09:36:00.902988 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [P.], seq 239:437, ack 2546, win 4374, options [nop,nop,TS val 41913871 ecr 3304081000], length 198
09:36:00.907031 IP 172.16.0.13.143 > 172.16.0.66.35641: Flags [P.], seq 2546:2780, ack 437, win 130, options [nop,nop,TS val 3304081011 ecr 41913871], length 234
09:36:00.908024 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [P.], seq 437:554, ack 2780, win 5098, options [nop,nop,TS val 41913872 ecr 3304081011], length 117
09:36:00.908429 IP 172.16.0.13.143 > 172.16.0.66.35641: Flags [P.], seq 2780:3089, ack 554, win 130, options [nop,nop,TS val 3304081012 ecr 41913872], length 309
09:36:00.946464 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [.], ack 3089, win 5822, options [nop,nop,TS val 41913882 ecr 3304081012], length 0
09:38:45.491173 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [P.], seq 554:591, ack 3089, win 5822, options [nop,nop,TS val 41955018 ecr 3304081012], length 37
09:38:45.491251 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [F.], seq 591, ack 3089, win 5822, options [nop,nop,TS val 41955018 ecr 3304081012], length 0
09:38:45.494136 IP 172.16.0.13.143 > 172.16.0.66.35641: Flags [P.], seq 3089:3174, ack 592, win 130, options [nop,nop,TS val 3304245600 ecr 41955018], length 85
09:38:45.494169 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [R], seq 2509538804, win 0, length 0
09:38:45.494176 IP 172.16.0.13.143 > 172.16.0.66.35641: Flags [F.], seq 3174, ack 592, win 130, options [nop,nop,TS val 3304245600 ecr 41955018], length 0
09:38:45.494221 IP 172.16.0.66.35641 > 172.16.0.13.143: Flags [R], seq 2509538804, win 0, length 0
09:38:50.493026 ARP, Request who-has 172.16.0.66 tell 172.16.0.13, length 46
09:38:50.493057 ARP, Reply 172.16.0.66 is-at 00:50:56:b5:81:b0, length 28