tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tap0, link-type EN10MB (Ethernet), capture size 96 bytes 000000 00:ff:68:f0:05:ed > 00:bd:bb:22:00:00, ethertype IPv4 (0x0800), length 62: 10.1.1.59.1298 > 10.1.1.1.22: S 1061955823:1061955823(0) win 16384 000022 00:15:17:35:52:f8 > 00:ff:68:f0:05:ed, ethertype IPv4 (0x0800), length 54: 10.1.1.1.22 > 10.1.1.59.1298: R 0:0(0) ack 1061955824 win 0 370240 00:ff:68:f0:05:ed > 00:bd:bb:22:00:00, ethertype IPv4 (0x0800), length 62: 10.1.1.59.1298 > 10.1.1.1.22: S 1061955823:1061955823(0) win 16384 000018 00:15:17:35:52:f8 > 00:ff:68:f0:05:ed, ethertype IPv4 (0x0800), length 54: 10.1.1.1.22 > 10.1.1.59.1298: R 0:0(0) ack 1 win 0 573169 00:ff:68:f0:05:ed > 00:bd:bb:22:00:00, ethertype IPv4 (0x0800), length 62: 10.1.1.59.1298 > 10.1.1.1.22: S 1061955823:1061955823(0) win 16384 000019 00:15:17:35:52:f8 > 00:ff:68:f0:05:ed, ethertype IPv4 (0x0800), length 54: 10.1.1.1.22 > 10.1.1.59.1298: R 0:0(0) ack 1 win 0 Try again.... 439977 00:ff:68:f0:05:ed > 00:bd:bb:22:00:00, ethertype IPv4 (0x0800), length 62: 10.1.1.59.1299 > 10.1.1.1.22: S 2742442603:2742442603(0) win 16384 000022 00:15:17:35:52:f8 > 00:ff:68:f0:05:ed, ethertype IPv4 (0x0800), length 54: 10.1.1.1.22 > 10.1.1.59.1299: R 0:0(0) ack 2742442604 win 0 571640 00:ff:68:f0:05:ed > 00:bd:bb:22:00:00, ethertype IPv4 (0x0800), length 62: 10.1.1.59.1299 > 10.1.1.1.22: S 2742442603:2742442603(0) win 16384 000017 00:15:17:35:52:f8 > 00:ff:68:f0:05:ed, ethertype IPv4 (0x0800), length 54: 10.1.1.1.22 > 10.1.1.59.1299: R 0:0(0) ack 1 win 0 437736 00:ff:68:f0:05:ed > 00:bd:bb:22:00:00, ethertype IPv4 (0x0800), length 62: 10.1.1.59.1299 > 10.1.1.1.22: S 2742442603:2742442603(0) win 16384 000016 00:15:17:35:52:f8 > 00:ff:68:f0:05:ed, ethertype IPv4 (0x0800), length 54: 10.1.1.1.22 > 10.1.1.59.1299: R 0:0(0) ack 1 win 0