ns:~# tcpdump -i eth0 host www.ru 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
08:58:52.119101 IP ns1.sampo.ru.45169 > www.ru.www: S 1705253931:1705253931(0) win 5840 <mss 1460,sackOK,timestamp 3795512213 0,nop,wscale 7>
08:58:52.184009 IP www.ru.www > ns1.sampo.ru.45169: S 812625372:812625372(0) ack 1705253932 win 57344 <mss 1460,nop,wscale 0,nop,nop,timestamp 787264036 3795512213>
08:58:52.184079 IP ns1.sampo.ru.45169 > www.ru.www: . ack 1 win 46 <nop,nop,timestamp 3795512229 2787264036>
08:59:00.930660 IP ns1.sampo.ru.45169 > www.ru.www: F 1:1(0) ack 1 win 46 <nop,nop,timestamp 3795514416 2787264036>
08:59:00.996509 IP www.ru.www > ns1.sampo.ru.45169: . ack 2 win 57920 <nop,nop,timestamp 2787264917 3795514416>
08:59:00.998361 IP www.ru.www > ns1.sampo.ru.45169: F 1:1(0) ack 2 win 57920 <nop,nop,timestamp 2787264917 3795514416>
08:59:00.998399 IP ns1.sampo.ru.45169 > www.ru.www: . ack 2 win 46 <nop,nop,timestamp 3795514432 2787264917>

7 packets captured
10100 packets received by filter
9752 packets dropped by kernel

ns:~# tcpdump -i eth0 host www.ru 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
09:02:25.507661 IP ns1.sampo.ru.33036 > www.ru.www: S 1934406518:1934406518(0) win 5840 <mss 1460,sackOK,timestamp 3795565558 0,nop,wscale 7>
09:02:25.532561 IP www.ru.www > ns1.sampo.ru.33036: S 2220223252:2220223252(0) ack 1934406519 win 57344 <mss 1460,nop,wscale 0,nop,nop,timestamp 2787285378 3795565558>
09:02:25.532633 IP ns1.sampo.ru.33036 > www.ru.www: . ack 1 win 46 <nop,nop,timestamp 3795565564 2787285378>
09:02:25.532564 IP www.ru.www > ns1.sampo.ru.33036: S 2220223252:2220223252(0) ack 1934406519 win 57344 <mss 1460,nop,wscale 0,nop,nop,timestamp 2787285378 3795565558>
09:02:25.532673 IP ns1.sampo.ru.33036 > www.ru.www: . ack 1 win 46 <nop,nop,timestamp 3795565564 2787285378>
09:02:29.974854 IP ns1.sampo.ru.33036 > www.ru.www: F 1:1(0) ack 1 win 46 <nop,nop,timestamp 3795566675 2787285378>
09:02:30.000388 IP www.ru.www > ns1.sampo.ru.33036: . ack 2 win 57920 <nop,nop,timestamp 2787285824 3795566675>
09:02:30.000518 IP www.ru.www > ns1.sampo.ru.33036: . ack 2 win 57920 <nop,nop,timestamp 2787285824 3795566675>
09:02:30.000520 IP www.ru.www > ns1.sampo.ru.33036: F 1:1(0) ack 2 win 57920 <nop,nop,timestamp 2787285824 3795566675>
09:02:30.000572 IP ns1.sampo.ru.33036 > www.ru.www: . ack 2 win 46 <nop,nop,timestamp 3795566681 2787285824>
09:02:30.000530 IP www.ru.www > ns1.sampo.ru.33036: F 1:1(0) ack 2 win 57920 <nop,nop,timestamp 2787285824 3795566675>
09:02:30.000597 IP ns1.sampo.ru.33036 > www.ru.www: . ack 2 win 46 <nop,nop,timestamp 3795566681 2787285824>
09:02:30.025646 IP www.ru.www > ns1.sampo.ru.33036: R 2220223254:2220223254(0) win 0
09:02:30.025914 IP www.ru.www > ns1.sampo.ru.33036: R 2220223254:2220223254(0) win 0