patrick@dagobert:~$ sudo tcpdump -i eth2 |grep 10.0.0.1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 96 bytes
23:25:51.641512 arp who-has dagobert tell 10.0.0.1
23:25:51.641630 IP 10.0.0.1.45294 > dagobert.2222: S 4253030555:4253030555(0) win 5840 <mss 1460,sackOK,timestamp 27244086 0,nop,wscale 5>
23:25:51.641786 IP dagobert.2222 > 10.0.0.1.45294: S 260701359:260701359(0) ack 4253030556 win 5792 <mss 1460,sackOK,timestamp 27239806 27244086,nop,wscale 1>
23:25:51.641905 IP 10.0.0.1.45294 > dagobert.2222: . ack 1 win 183 <nop,nop,timestamp 27244087 27239806>
23:25:51.659843 IP dagobert.2222 > 10.0.0.1.45294: P 1:39(38) ack 1 win 2896 <nop,nop,timestamp 27239808 27244087>
23:25:51.659952 IP 10.0.0.1.45294 > dagobert.2222: . ack 39 win 183 <nop,nop,timestamp 27244089 27239808>
23:25:51.660118 IP 10.0.0.1.45294 > dagobert.2222: P 1:39(38) ack 39 win 183 <nop,nop,timestamp 27244089 27239808>
23:25:51.711982 IP 10.0.0.1.32777 > dagobert.domain:  49291+ PTR? 254.0.0.10.in-addr.arpa. (41)
23:25:51.871565 IP 10.0.0.1.45294 > dagobert.2222: P 1:39(38) ack 39 win 183 <nop,nop,timestamp 27244110 27239808>
23:25:52.287259 IP 10.0.0.1.45294 > dagobert.2222: P 1:39(38) ack 39 win 183 <nop,nop,timestamp 27244152 27239808>
23:25:53.127276 IP 10.0.0.1.45294 > dagobert.2222: P 1:39(38) ack 39 win 183 <nop,nop,timestamp 27244236 27239808>
23:25:54.797471 IP 10.0.0.1.45294 > dagobert.2222: P 1:39(38) ack 39 win 183 <nop,nop,timestamp 27244404 27239808>
23:25:56.697507 IP 10.0.0.1.32777 > dagobert.domain:  49291+ PTR? 254.0.0.10.in-addr.arpa. (41)
23:25:58.146217 IP 10.0.0.1.45294 > dagobert.2222: P 1:39(38) ack 39 win 183 <nop,nop,timestamp 27244740 27239808>
23:26:01.709204 IP 10.0.0.1.32777 > dagobert.domain:  26135+ PTR? 254.0.0.10.in-addr.arpa. (41)
23:26:04.878949 IP 10.0.0.1.45294 > dagobert.2222: P 1:39(38) ack 39 win 183 <nop,nop,timestamp 27245412 27239808>
23:26:06.679818 IP 10.0.0.1.32777 > dagobert.domain:  26135+ PTR? 254.0.0.10.in-addr.arpa. (41)
23:26:18.307370 IP 10.0.0.1.45294 > dagobert.2222: P 1:39(38) ack 39 win 183 <nop,nop,timestamp 27246756 27239808>
23:26:45.161553 IP 10.0.0.1.45294 > dagobert.2222: P 1:39(38) ack 39 win 183 <nop,nop,timestamp 27249444 27239808>
23:26:50.190039 arp who-has dagobert tell 10.0.0.1
23:27:25.115853 IP 10.0.0.1.45294 > dagobert.2222: FP 39:751(712) ack 39 win 183 <nop,nop,timestamp 27253434 27239808>
797 packets captured
799 packets received by filter
0 packets dropped by kernel