gistfile1.txt

root@nucklehead:~ # tcpdump -i bridge1 --immediate-mode 'host 10.0.0.1'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bridge1, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured
22 packets received by filter
0 packets dropped by kernel
root@nucklehead:~ # tcpdump -i em0 --immediate-mode 'host 10.0.0.1'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured
3175 packets received by filter
0 packets dropped by kernel
root@nucklehead:~ # tcpdump -i em0 --immediate-mode 'host 10.0.0.1'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em0, link-type EN10MB (Ethernet), capture size 262144 bytes
14:36:08.694852 IP nucklehead.49297 > 10.0.0.1.ssh: Flags [S], seq 3203534683, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 338465326 ecr 0], length 0
14:36:09.730896 IP nucklehead.49297 > 10.0.0.1.ssh: Flags [S], seq 3203534683, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 338466362 ecr 0], length 0
14:36:11.944779 IP nucklehead.49297 > 10.0.0.1.ssh: Flags [S], seq 3203534683, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 338468576 ecr 0], length 0
14:36:16.144386 IP nucklehead.49297 > 10.0.0.1.ssh: Flags [S], seq 3203534683, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 338472776 ecr 0], length 0