[root@atg etc]# tcpdump -i eth0 -n not port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
13:16:26.814923 arp who-has 192.168.1.72 (Broadcast) tell 192.168.1.200
13:16:29.469672 IP 192.168.1.240.41277 > 192.168.1.2.domain:  30244+ A? google.ca. (27)
13:16:29.470126 IP 192.168.1.2.domain > 192.168.1.240.41277:  30244 3/4/4 A 64.233.161.104,[|domain]
13:16:29.470375 IP 192.168.1.240 > 64.233.161.104: icmp 64: echo request seq 0
13:16:30.376760 00:18:fe:c6:3b:e8 > 01:80:c2:00:00:0e, ethertype Unknown (0x88cc), length 182:
        0x0000:  0207 0400 18fe c63b c004 0307 3234 0602  .......;....24..
        0x0010:  0078 0802 3234 0a14 5072 6f43 7572 7665  .x..24..ProCurve
        0x0020:  2053 7769 7463 6820 3236 3236 0c59 5072  .Switch.2626.YPr
        0x0030:  6f43 7572 7665 204a 3439 3030 4220 5377  oCurve.J4900B.Sw
        0x0040:  6974 6368 2032 3632 362c 2072 6576 6973  itch.2626,.revis
        0x0050:  696f                                     io
13:16:30.469879 IP 192.168.1.240 > 64.233.161.104: icmp 64: echo request seq 1
13:16:31.470735 IP 192.168.1.240 > 64.233.161.104: icmp 64: echo request seq 2
13:16:31.739742 IP 192.168.1.240.microsoft-ds > 192.168.1.72.1270: P 226261847:226261851(4) ack 2796110841 win 10960
13:16:31.904263 arp who-has 192.168.1.240 tell 192.168.1.72
13:16:31.904274 arp reply 192.168.1.240 is-at 00:18:fe:31:d5:32
13:16:31.904494 IP 192.168.1.72.1270 > 192.168.1.240.microsoft-ds: . ack 4 win 65277
13:16:32.470636 IP 192.168.1.240 > 64.233.161.104: icmp 64: echo request seq 3
13:16:33.471498 IP 192.168.1.240 > 64.233.161.104: icmp 64: echo request seq 4
13:16:34.468355 arp who-has 192.168.1.2 tell 192.168.1.240
13:16:34.468522 arp reply 192.168.1.2 is-at 00:30:48:77:e0:6d
13:16:34.469360 arp who-has 192.168.1.1 tell 192.168.1.240
13:16:34.469513 arp reply 192.168.1.1 is-at 00:06:b1:35:d9:c4
13:16:34.471382 IP 192.168.1.240 > 64.233.161.104: icmp 64: echo request seq 5
13:16:34.517147 arp reply 192.168.1.1 is-at 00:06:b1:35:d9:c4
13:16:34.850380 IP 192.168.1.1.router > 192.168.1.255.router: RIPv1, Response, length: 24
13:16:35.251535 IP 192.168.1.138.1117 > 192.168.1.240.microsoft-ds: P 3495775254:3495775307(53) ack 948568636 win 65270
13:16:35.251675 IP 192.168.1.240.microsoft-ds > 192.168.1.138.1117: P 1:54(53) ack 53 win 32767
13:16:35.438952 IP 192.168.1.138.1117 > 192.168.1.240.microsoft-ds: . ack 54 win 65217

23 packets captured
23 packets received by filter
0 packets dropped by kernel
[root@atg etc]#