client ( 10.20.63.90) ---> 10.20.63.60 firewall 10.20.73.1 ---> server ssh 10.20.73.2(neon) Packet is ok trough the firewall and snoop on server ssh : 10.20.63.90 -> neon TCP D=22 S=3184 Syn Seq=3901661810 Len=0 Win=64512 Options= neon -> (broadcast) ARP C Who is 10.20.63.90, 10.20.63.90 ? neon -> (broadcast) ARP C Who is 10.20.63.90, 10.20.63.90 ? neon -> (broadcast) ARP C Who is 10.20.63.90, 10.20.63.90 ? neon -> (broadcast) ARP C Who is 10.20.63.90, 10.20.63.90 ? 10.20.63.90 -> neon TCP D=22 S=3184 Syn Seq=3901661810 Len=0 Win=64512 Options= neon -> (broadcast) ARP C Who is 10.20.63.90, 10.20.63.90 ? neon -> (broadcast) ARP C Who is 10.20.63.90, 10.20.63.90 ? 10.20.63.90 -> neon TCP D=22 S=3184 Syn Seq=3901661810 Len=0 Win=64512 Options= neon -> (broadcast) ARP C Who is 10.20.63.90, 10.20.63.90 ? neon -> (broadcast) ARP C Who is 10.20.63.90, 10.20.63.90 ? neon -> (broadcast) ARP C Who is 10.20.63.90, 10.20.63.90 ? neon -> (broadcast) ARP C Who is 10.20.63.90, 10.20.63.90 ? netstat -rn : Routing Table: IPv4 Destination Gateway Flags Ref Use Interface -------------------- -------------------- ----- ----- ------ --------- 10.20.63.0 10.20.73.1 UGH 1 0 10.0.0.0 10.20.73.2 U 1 245 hme0 224.0.0.0 10.20.73.2 U 1 0 hme0 default 10.20.73.1 UG 1 0 127.0.0.1 127.0.0.1 UH 1 10 lo0