[root@gw /etc]# tcpdump -i vlan3 -n -l port 3389 | grep 192.168.21.156
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vlan3, link-type EN10MB (Ethernet), capture size 262144 bytes
14:58:01.463021 IP 10.121.21.156.60968 > 192.168.21.156.3389: Flags [S], seq 3362346516, win 64240, options [mss 1361,nop,wscale 8,nop,nop,sackOK], length 0
14:58:01.463196 IP 192.168.21.156.3389 > 10.121.21.156.60968: Flags [S.], seq 2799702837, ack 3362346517, win 64000, options [mss 1460,nop,wscale 0,nop,nop,sackOK], length 0
14:58:01.469851 IP 10.121.21.156.60968 > 192.168.21.156.3389: Flags [.], ack 1, win 1026, length 0
14:58:01.470138 IP 192.168.21.156.3389 > 178.209.124.226.56983: Flags [F.], seq 503857898, ack 1677412320, win 64000, length 0
14:58:01.470511 IP 10.121.21.156.60968 > 192.168.21.156.3389: Flags [P.], seq 1:48, ack 1, win 1026, length 47
14:58:01.473130 IP 192.168.21.156.3389 > 10.121.21.156.60968: Flags [P.], seq 1:20, ack 48, win 63953, length 19
14:58:01.530011 IP 10.121.21.156.60968 > 192.168.21.156.3389: Flags [.], ack 20, win 1025, length 0
14:58:01.782071 IP 192.168.21.156.3389 > 178.209.124.226.56983: Flags [F.], seq 0, ack 1, win 64000, length 0
14:58:02.397150 IP 192.168.21.156.3389 > 178.209.124.226.56983: Flags [F.], seq 0, ack 1, win 64000, length 0
14:58:03.597714 IP 192.168.21.156.3389 > 178.209.124.226.56983: Flags [F.], seq 0, ack 1, win 64000, length 0
14:58:05.222136 IP 10.121.21.156.60968 > 192.168.21.156.3389: Flags [P.], seq 48:233, ack 20, win 1025, length 185
14:58:05.222835 IP 192.168.21.156.3389 > 10.121.21.156.60968: Flags [P.], seq 20:880, ack 233, win 63768, length 860
14:58:05.227146 IP 10.121.21.156.60968 > 192.168.21.156.3389: Flags [P.], seq 233:551, ack 880, win 1022, length 318
14:58:05.228443 IP 192.168.21.156.3389 > 10.121.21.156.60968: Flags [P.], seq 880:931, ack 551, win 63450, length 51
14:58:05.250419 IP 10.121.21.156.60968 > 192.168.21.156.3389: Flags [P.], seq 551:637, ack 931, win 1022, length 86
14:58:05.250862 IP 192.168.21.156.3389 > 10.121.21.156.60968: Flags [P.], seq 931:1215, ack 637, win 63364, length 284
14:58:05.256359 IP 10.121.21.156.60968 > 192.168.21.156.3389: Flags [P.], seq 637:1299, ack 1215, win 1021, length 662
14:58:05.259923 IP 192.168.21.156.3389 > 10.121.21.156.60968: Flags [P.], seq 1215:1259, ack 1299, win 62702, length 44
14:58:05.264750 IP 10.121.21.156.60968 > 192.168.21.156.3389: Flags [R.], seq 1299, ack 1259, win 0, length 0
14:58:06.011375 IP 192.168.21.156.3389 > 178.209.124.226.56983: Flags [F.], seq 0, ack 1, win 64000, length 0
14:58:10.820780 IP 192.168.21.156.3389 > 178.209.124.226.56983: Flags [F.], seq 0, ack 1, win 64000, length 0
14:58:20.423107 IP 192.168.21.156.3389 > 178.209.124.226.56983: Flags [R.], seq 1, ack 1, win 0, length 0