rendered paste body# tcpdump -eni lagg0 'host 192.168.1.2'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lagg0, link-type EN10MB (Ethernet), capture size 65535 bytes
23:32:08.301786 00:14:22:be:7a:a1 > e0:cb:4e:8d:96:59, ethertype IPv4 (0x0800), length 98: 192.168.1.182 > 192.168.1.2: ICMP echo request, id 51976, seq 0, length 64
23:32:08.304922 e0:cb:4e:8d:96:59 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 192.168.1.182 tell 192.168.1.2, length 46
23:32:08.304977 00:14:22:be:7a:a1 > e0:cb:4e:8d:96:59, ethertype ARP (0x0806), length 42: Reply 192.168.1.182 is-at 00:14:22:be:7a:a1, length 28
23:32:08.306056 e0:cb:4e:8d:96:59 > 00:14:22:be:7a:a1, ethertype IPv4 (0x0800), length 98: 192.168.1.2 > 192.168.1.182: ICMP echo reply, id 51976, seq 0, length 64
23:32:09.304284 00:14:22:be:7a:a1 > e0:cb:4e:8d:96:59, ethertype IPv4 (0x0800), length 98: 192.168.1.182 > 192.168.1.2: ICMP echo request, id 51976, seq 1, length 64
23:32:09.305555 e0:cb:4e:8d:96:59 > 00:14:22:be:7a:a1, ethertype IPv4 (0x0800), length 98: 192.168.1.2 > 192.168.1.182: ICMP echo reply, id 51976, seq 1, length 64
23:32:10.305456 00:14:22:be:7a:a1 > e0:cb:4e:8d:96:59, ethertype IPv4 (0x0800), length 98: 192.168.1.182 > 192.168.1.2: ICMP echo request, id 51976, seq 2, length 64
23:32:10.306557 e0:cb:4e:8d:96:59 > 00:14:22:be:7a:a1, ethertype IPv4 (0x0800), length 98: 192.168.1.2 > 192.168.1.182: ICMP echo reply, id 51976, seq 2, length 64
23:32:11.306732 00:14:22:be:7a:a1 > e0:cb:4e:8d:96:59, ethertype IPv4 (0x0800), length 98: 192.168.1.182 > 192.168.1.2: ICMP echo request, id 51976, seq 3, length 64
23:32:11.310405 e0:cb:4e:8d:96:59 > 00:14:22:be:7a:a1, ethertype IPv4 (0x0800), length 98: 192.168.1.2 > 192.168.1.182: ICMP echo reply, id 51976, seq 3, length 64