debian506:/home/cateye# tcpdump -vv host 192.168.1.96
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
15:08:45.297727 IP (tos 0x0, ttl 128, id 31352, offset 0, flags [DF], proto TCP (6), length 391)
192.168.1.30.3385 > 192.168.1.96.www: Flags [P.], cksum 0x157a (correct), seq 1013044332:1013044683, ack 286326784, win 65535, length 351
15:08:45.382735 IP (tos 0x0, ttl 64, id 8316, offset 0, flags [DF], proto TCP (6), length 60)
debian506.local.53229 > 192.168.1.96.www: Flags [S], cksum 0x3e39 (correct), seq 3656897143, win 5840, options [mss 1460,sackOK,TS val 1831435 ecr 0,nop,wscale 5], length 0
15:08:45.391289 IP (tos 0x0, ttl 64, id 8316, offset 0, flags [DF], proto TCP (6), length 48)
192.168.1.96.www > debian506.local.53229: Flags [S.] [bad hdr length 40 - too long, > 28]
15:08:48.382718 IP (tos 0x0, ttl 64, id 8317, offset 0, flags [DF], proto TCP (6), length 60)
debian506.local.53229 > 192.168.1.96.www: Flags [S], cksum 0x3b4b (correct), seq 3656897143, win 5840, options [mss 1460,sackOK,TS val 1832185 ecr 0,nop,wscale 5], length 0
15:08:48.391438 IP (tos 0x0, ttl 64, id 8317, offset 0, flags [DF], proto TCP (6), length 48)
192.168.1.96.www > debian506.local.53229: Flags [S.] [bad hdr length 40 - too long, > 28]
15:08:50.730296 IP (tos 0x0, ttl 128, id 31419, offset 0, flags [DF], proto TCP (6), length 381)
192.168.1.30.3389 > 192.168.1.96.www: Flags [P.], cksum 0xb8e4 (correct), seq 4280575586:4280575927, ack 286326784, win 65535, length 341
15:08:53.382567 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.96 tell debian506.local, length 28
15:08:53.384670 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.1.96 is-at 45:c6:b3:f3:ab:9e (oui Unknown), length 46
15:08:54.382572 IP (tos 0x0, ttl 64, id 8318, offset 0, flags [DF], proto TCP (6), length 60)
debian506.local.53229 > 192.168.1.96.www: Flags [S], cksum 0x356f (correct), seq 3656897143, win 5840, options [mss 1460,sackOK,TS val 1833685 ecr 0,nop,wscale 5], length 0
15:08:54.409087 IP (tos 0x0, ttl 64, id 8318, offset 0, flags [DF], proto TCP (6), length 48)
192.168.1.96.www > debian506.local.53229: Flags [S.] [bad hdr length 40 - too long, > 28]
15:08:57.267583 IP (tos 0x0, ttl 128, id 31504, offset 0, flags [DF], proto TCP (6), length 381)
192.168.1.30.3391 > 192.168.1.96.www: Flags [P.], cksum 0xb171 (correct), seq 1859255846:1859256187, ack 286326784, win 65535, length 341
15:09:06.621099 IP (tos 0x0, ttl 128, id 31549, offset 0, flags [DF], proto TCP (6), length 381)
192.168.1.30.3395 > 192.168.1.96.www: Flags [P.], cksum 0x9869 (correct), seq 2532825602:2532825943, ack 286326784, win 65535, length 341
15:09:17.982006 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.96 tell 192.168.1.30, length 46
15:09:17.983737 IP (tos 0x0, ttl 128, id 31609, offset 0, flags [DF], proto TCP (6), length 391)
192.168.1.30.3399 > 192.168.1.96.www: Flags [P.], cksum 0xa4d1 (correct), seq 4145646158:4145646509, ack 286326784, win 65535, length 351
|