Stuff

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wan1, link-type EN10MB (Ethernet), capture size 96 bytes
19:21:25.226972 arp who-has 10.0.0.60 tell 10.0.0.81
19:21:25.228495 arp reply 10.0.0.60 is-at 00:50:04:55:5c:38 (oui Unknown)
19:21:25.228562 IP 10.0.0.81.56008 > 10.0.0.60.ssh: S 3282568731:3282568731(0) win 5840 <mss 1460,sackOK,timestamp 301453496 0,nop,wscale 6>
19:21:25.228952 IP 10.0.0.60.ssh > 10.0.0.81.56008: S 2639576190:2639576190(0) ack 3282568732 win 5792 <mss 1460,sackOK,timestamp 136986011 301453496,nop,wscale 6>
19:21:25.232869 IP 10.0.0.81.56008 > 10.0.0.60.ssh: . ack 1 win 92 <nop,nop,timestamp 301453497 136986011>
19:21:25.246342 IP 10.0.0.60.ssh > 10.0.0.81.56008: P 1:32(31) ack 1 win 91 <nop,nop,timestamp 136986015 301453497>
19:21:25.248540 IP 10.0.0.81.56008 > 10.0.0.60.ssh: . ack 32 win 92 <nop,nop,timestamp 301453499 136986015>

7 packets captured
7 packets received by filter
0 packets dropped by kernel


root@gateway / # tcpdump -i eth1.3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1.3, link-type EN10MB (Ethernet), capture size 96 bytes
19:22:59.597180 IP 192.168.2.100.56010 > 10.0.0.60.ssh: FP 3370458900:3370459692(792) ack 2713661313 win 92 <nop,nop,timestamp 301462933 137007098>
19:23:01.280840 IP 192.168.2.100.56011 > 10.0.0.60.ssh: S 3380260613:3380260613(0) win 5840 <mss 1460,sackOK,timestamp 301463102 0,nop,wscale 6>
19:23:01.283354 IP 10.0.0.60.ssh > 192.168.2.100.56011: S 2735143280:2735143280(0) ack 3380260614 win 5792 <mss 1460,sackOK,timestamp 137010022 301463102,nop,wscale 6>
19:23:01.284770 IP 192.168.2.100.56011 > 10.0.0.60.ssh: . ack 1 win 92 <nop,nop,timestamp 301463102 137010022>
19:23:01.301253 IP 10.0.0.60.ssh > 192.168.2.100.56011: P 1:32(31) ack 1 win 91 <nop,nop,timestamp 137010027 301463102>
19:23:01.301515 IP 192.168.2.100.56011 > 10.0.0.60.ssh: . ack 32 win 92 <nop,nop,timestamp 301463104 137010027>
19:23:01.301613 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463104 137010027>
19:23:01.509017 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463125 137010027>
19:23:01.930189 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463167 137010027>
19:23:02.769841 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463251 137010027>
19:23:02.810206 IP 192.168.2.100.56010 > 10.0.0.60.ssh: P 4294967276:0(20) ack 1 win 92 <nop,nop,timestamp 301463255 137007098>
19:23:04.165954 IP 192.168.2.100.56011 > 10.0.0.60.ssh: FP 21:813(792) ack 32 win 92 <nop,nop,timestamp 301463390 137010027>
19:23:04.450251 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463419 137010027>
19:23:07.809160 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463755 137010027>

14 packets captured
14 packets received by filter
0 packets dropped by kernel
root@gateway / # tcpdump -i eth1.3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1.3, link-type EN10MB (Ethernet), capture size 96 bytes
19:22:59.597180 IP 192.168.2.100.56010 > 10.0.0.60.ssh: FP 3370458900:3370459692(792) ack 2713661313 win 92 <nop,nop,timestamp 301462933 137007098>
19:23:01.280840 IP 192.168.2.100.56011 > 10.0.0.60.ssh: S 3380260613:3380260613(0) win 5840 <mss 1460,sackOK,timestamp 301463102 0,nop,wscale 6>
19:23:01.283354 IP 10.0.0.60.ssh > 192.168.2.100.56011: S 2735143280:2735143280(0) ack 3380260614 win 5792 <mss 1460,sackOK,timestamp 137010022 301463102,nop,wscale 6>
19:23:01.284770 IP 192.168.2.100.56011 > 10.0.0.60.ssh: . ack 1 win 92 <nop,nop,timestamp 301463102 137010022>
19:23:01.301253 IP 10.0.0.60.ssh > 192.168.2.100.56011: P 1:32(31) ack 1 win 91 <nop,nop,timestamp 137010027 301463102>
19:23:01.301515 IP 192.168.2.100.56011 > 10.0.0.60.ssh: . ack 32 win 92 <nop,nop,timestamp 301463104 137010027>
19:23:01.301613 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463104 137010027>
19:23:01.509017 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463125 137010027>
19:23:01.930189 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463167 137010027>
19:23:02.769841 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463251 137010027>
19:23:02.810206 IP 192.168.2.100.56010 > 10.0.0.60.ssh: P 4294967276:0(20) ack 1 win 92 <nop,nop,timestamp 301463255 137007098>
19:23:04.165954 IP 192.168.2.100.56011 > 10.0.0.60.ssh: FP 21:813(792) ack 32 win 92 <nop,nop,timestamp 301463390 137010027>
19:23:04.450251 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463419 137010027>
19:23:07.809160 IP 192.168.2.100.56011 > 10.0.0.60.ssh: P 1:21(20) ack 32 win 92 <nop,nop,timestamp 301463755 137010027>

14 packets captured
14 packets received by filter
0 packets dropped by kernel