utm:/root # tcpdump -n dst host 192.168.2.1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
20:20:40.510666 IP 192.168.1.25.41844 > 192.168.2.1.80: Flags [S], seq 51990498, win 65535, options [mss 1460,sackOK,TS val 36262272 ecr 0,nop,wscale 8], length 0
20:20:40.510678 IP 192.168.1.25.41848 > 192.168.2.1.80: Flags [S], seq 1290693950, win 65535, options [mss 1460,sackOK,TS val 36262272 ecr 0,nop,wscale 8], length 0
20:20:40.513538 IP 192.168.1.25.41847 > 192.168.2.1.80: Flags [S], seq 3474324114, win 65535, options [mss 1460,sackOK,TS val 36262272 ecr 0,nop,wscale 8], length 0
20:20:40.513549 IP 192.168.1.25.41845 > 192.168.2.1.80: Flags [S], seq 4232341149, win 65535, options [mss 1460,sackOK,TS val 36262272 ecr 0,nop,wscale 8], length 0
20:20:40.513555 IP 192.168.1.25.41846 > 192.168.2.1.80: Flags [S], seq 1874858709, win 65535, options [mss 1460,sackOK,TS val 36262272 ecr 0,nop,wscale 8], length 0
20:20:40.514735 IP 192.168.1.25.41849 > 192.168.2.1.80: Flags [S], seq 1037893966, win 65535, options [mss 1460,sackOK,TS val 36262272 ecr 0,nop,wscale 8], length 0
20:20:45.523294 ARP, Request who-has 192.168.2.1 tell 192.168.2.2, length 28