root@mxgw:~# tcpdump -i eth0 port 389
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:34:36.355076 IP 192.168.135.9.59727 > srvleon.mailgw.com.ldap: Flags [S], seq 1470389482, win 5840, options [mss 1460,sackOK,TS val 1191504975 ecr 0,nop,wscale 6], length 0
16:34:36.355362 IP srvleon.mailgw.com.ldap > 192.168.135.9.59727: Flags [S.], seq 2510267230, ack 1470389483, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 476329174 ecr 1191504975], length 0
16:34:36.355385 IP 192.168.135.9.59727 > srvleon.mailgw.com.ldap: Flags [.], ack 1, win 92, options [nop,nop,TS val 1191504975 ecr 476329174], length 0
16:34:36.356892 IP 192.168.135.9.59727 > srvleon.mailgw.com.ldap: Flags [P.], seq 1:58, ack 1, win 92, options [nop,nop,TS val 1191504976 ecr 476329174], length 57
16:34:36.360987 IP srvleon.mailgw.com.ldap > 192.168.135.9.59727: Flags [P.], seq 1:23, ack 58, win 260, options [nop,nop,TS val 476329174 ecr 1191504976], length 22
16:34:36.361087 IP 192.168.135.9.59727 > srvleon.mailgw.com.ldap: Flags [.], ack 23, win 92, options [nop,nop,TS val 1191504977 ecr 476329174], length 0
16:34:36.361087 IP 192.168.135.9.59727 > srvleon.mailgw.com.ldap: Flags [.], ack 23, win 92, options [nop,nop,TS val 1191504977 ecr 476329174], length 0
16:34:36.370483 IP 192.168.135.9.59727 > srvleon.mailgw.com.ldap: Flags [P.], seq 58:462, ack 23, win 92, options [nop,nop,TS val 1191504979 ecr 476329174], length 404
16:34:36.379843 IP srvleon.mailgw.com.ldap > 192.168.135.9.59727: Flags [.], seq 23:1471, ack 462, win 258, options [nop,nop,TS val 476329175 ecr 1191504979], length 1448
16:34:36.379857 IP srvleon.mailgw.com.ldap > 192.168.135.9.59727: Flags [.], seq 1471:2919, ack 462, win 258, options [nop,nop,TS val 476329175 ecr 1191504979], length 1448
16:34:36.379868 IP 192.168.135.9.59727 > srvleon.mailgw.com.ldap: Flags [.], ack 2919, win 182, options [nop,nop,TS val 1191504981 ecr 476329175], length 0
16:34:36.380276 IP srvleon.mailgw.com.ldap > 192.168.135.9.59727: Flags [.], seq 2919:4367, ack 462, win 258, options [nop,nop,TS val 476329177 ecr 1191504981], length 1448