[root@mbox ~]# tcpdump -n "host 192.168.129.9"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
17:26:25.180503 IP 202.5.145.56.3667 > 192.168.129.9.http: S 1431363018:1431363018(0) win 65535 <mss 1460,nop,nop,sackOK>
17:26:25.420128 IP 192.168.129.9.2055 > 239.255.255.250.1900: UDP, length 287
17:26:25.427892 IP 192.168.129.9.2055 > 239.255.255.250.1900: UDP, length 287
17:26:25.434898 IP 192.168.129.9.2055 > 239.255.255.250.1900: UDP, length 298
17:26:25.442517 IP 192.168.129.9.2055 > 239.255.255.250.1900: UDP, length 298
17:26:25.449387 IP 192.168.129.9.2055 > 239.255.255.250.1900: UDP, length 343
17:26:25.457089 IP 192.168.129.9.2055 > 239.255.255.250.1900: UDP, length 343
17:26:28.155837 IP 202.5.145.56.3667 > 192.168.129.9.http: S 1431363018:1431363018(0) win 65535 <mss 1460,nop,nop,sackOK>
17:26:30.179072 arp who-has 192.168.129.9 tell 192.168.129.253
17:26:30.182956 arp reply 192.168.129.9 is-at 00:30:4f:42:72:a4
17:26:34.073623 IP 202.5.145.56.3667 > 192.168.129.9.http: S 1431363018:1431363018(0) win 65535 <mss 1460,nop,nop,sackOK>