rendered paste bodyrmccurdy# tcpdump -n | grep 226
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ed0, link-type EN10MB (Ethernet), capture size 96 bytes
06:49:11.046026 IP 66.23.216.226.22432 > 192.168.1.99.22: S 973573207:973573207(0) win 65535 <mss 1372,nop,nop,sackOK>
06:49:11.046279 IP 192.168.1.99.22 > 66.23.216.226.22432: S 1809638876:1809638876(0) ack 973573208 win 65535 <mss 1460,sackOK,eol>
06:49:11.064016 IP 66.23.216.226.22432 > 192.168.1.99.22: . ack 1 win 65535
06:49:11.137308 IP 192.168.1.99.22 > 66.23.216.226.22432: P 1:40(39) ack 1 win 65535
06:49:11.157469 IP 66.23.216.226.22432 > 192.168.1.99.22: P 1:29(28) ack 40 win 65496
06:49:11.171277 IP 192.168.1.99.22 > 66.23.216.226.22432: P 40:736(696) ack 29 win 65535
06:49:11.206396 IP 66.23.216.226.22432 > 192.168.1.99.22: P 533:549(16) ack 736 win 64800
06:49:11.206513 IP 192.168.1.99.22 > 66.23.216.226.22432: . ack 29 win 65535 <nop,nop,sack 1 {533:549}>
06:49:11.210340 IP 66.23.216.226.22432 > 192.168.1.99.22: P 29:533(504) ack 736 win 64800
06:49:11.210473 IP 192.168.1.99.22 > 66.23.216.226.22432: . ack 549 win 65336
06:49:11.239848 IP 192.168.1.99.22 > 66.23.216.226.22432: P 736:1016(280) ack 549 win 65535
06:49:11.637583 IP 66.23.216.226.22432 > 192.168.1.99.22: P 549:821(272) ack 1016 win 64520
06:49:11.736944 IP 192.168.1.99.22 > 66.23.216.226.22432: . ack 821 win 65535
06:49:11.765280 IP 192.168.1.99.22 > 66.23.216.226.22432: P 1016:2184(1168) ack 821 win 65535
06:49:12.113724 IP 66.23.216.226.22432 > 192.168.1.99.22: P 821:837(16) ack 2184 win 65535
06:49:12.114437 IP 66.23.216.226.22432 > 192.168.1.99.22: P 837:889(52) ack 2184 win 65535
06:49:12.114577 IP 192.168.1.99.22 > 66.23.216.226.22432: . ack 889 win 65535
06:49:12.115617 IP 192.168.1.99.22 > 66.23.216.226.22432: P 2184:2236(52) ack 889 win 65535
06:49:12.137659 IP 66.23.216.226.22432 > 192.168.1.99.22: P 889:957(68) ack 2236 win 65483
06:49:12.140673 IP 192.168.1.99.49592 > 192.168.1.254.53: 14190+ PTR? 226.216.23.66.in-addr.arpa. (44)
06:49:12.237807 IP 192.168.1.99.22 > 66.23.216.226.22432: . ack 957 win 65535
NOTE: it dies on > 192.168.1.254.53: 14190+ PTR? 226.216.23.66.in-addr.arpa.
ssh server has static value for ip in /etc/hosts still no luck