# /usr/sbin/tcpdump -i ppp0 -vv | grep smtp
tcpdump: listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
23:33:48.910808 IP (tos 0x0, ttl  64, id 20697, offset 0, flags [DF], proto 6, length: 52) c1.kckk.ru.33494 > kckk.ru.smtp: S [tcp sum ok] 2728425058:2728425058(0) win 5840 <mss 1460,nop,nop,sackOK,nop,wscale 0>
23:33:49.025217 IP (tos 0x0, ttl  64, id 25045, offset 0, flags [DF], proto 6, length: 52) kckk.ru.smtp > c1.kckk.ru.33494: S [tcp sum ok] 4050692007:4050692007(0) ack 2728425059 win 5840 <mss 1460,nop,nop,sackOK,nop,wscale 0>
23:33:49.025335 IP (tos 0x0, ttl  64, id 20698, offset 0, flags [DF], proto 6, length: 40) c1.kckk.ru.33494 > kckk.ru.smtp: . [tcp sum ok] 1:1(0) ack 1 win 5840
23:33:49.455192 IP (tos 0x0, ttl  64, id 25103, offset 0, flags [DF], proto 6, length: 115) kckk.ru.smtp > c1.kckk.ru.33494: P 1:76(75) ack 1 win 5840
23:33:49.455275 IP (tos 0x0, ttl  64, id 20699, offset 0, flags [DF], proto 6, length: 40) c1.kckk.ru.33494 > kckk.ru.smtp: . [tcp sum ok] 1:1(0) ack 76 win 5840
23:33:49.457435 IP (tos 0x0, ttl  64, id 20700, offset 0, flags [DF], proto 6, length: 61) c1.kckk.ru.33494 > kckk.ru.smtp: P [tcp sum ok] 1:22(21) ack 76 win 5840
23:33:49.555161 IP (tos 0x0, ttl  64, id 25106, offset 0, flags [DF], proto 6, length: 40) kckk.ru.smtp > c1.kckk.ru.33494: . [tcp sum ok] 76:76(0) ack 22 win 5840
23:33:49.595186 IP (tos 0x0, ttl  64, id 25117, offset 0, flags [DF], proto 6, length: 215) kckk.ru.smtp > c1.kckk.ru.33494: P 76:251(175) ack 22 win 5840
23:33:49.598333 IP (tos 0x0, ttl  64, id 20701, offset 0, flags [DF], proto 6, length: 77) c1.kckk.ru.33494 > kckk.ru.smtp: P [tcp sum ok] 22:59(37) ack 251 win 6432
23:33:49.705157 IP (tos 0x0, ttl  64, id 25119, offset 0, flags [DF], proto 6, length: 40) kckk.ru.smtp > c1.kckk.ru.33494: . [tcp sum ok] 251:251(0) ack 59 win 5840
23:33:49.715171 IP (tos 0x0, ttl  64, id 25130, offset 0, flags [DF], proto 6, length: 78) kckk.ru.smtp > c1.kckk.ru.33494: P [tcp sum ok] 251:289(38) ack 59 win 5840
23:33:49.715859 IP (tos 0x0, ttl  64, id 20702, offset 0, flags [DF], proto 6, length: 63) c1.kckk.ru.33494 > kckk.ru.smtp: P [tcp sum ok] 59:82(23) ack 289 win 6432
23:33:49.855155 IP (tos 0x0, ttl  64, id 25134, offset 0, flags [DF], proto 6, length: 40) kckk.ru.smtp > c1.kckk.ru.33494: . [tcp sum ok] 289:289(0) ack 82 win 5840
23:33:49.865160 IP (tos 0x0, ttl  64, id 25140, offset 0, flags [DF], proto 6, length: 81) kckk.ru.smtp > c1.kckk.ru.33494: P 289:330(41) ack 82 win 5840
23:33:49.866070 IP (tos 0x0, ttl  64, id 20703, offset 0, flags [DF], proto 6, length: 46) c1.kckk.ru.33494 > kckk.ru.smtp: P [tcp sum ok] 82:88(6) ack 330 win 6432
23:33:49.965156 IP (tos 0x0, ttl  64, id 25141, offset 0, flags [DF], proto 6, length: 40) kckk.ru.smtp > c1.kckk.ru.33494: . [tcp sum ok] 330:330(0) ack 88 win 5840
23:33:49.975171 IP (tos 0x0, ttl  64, id 25142, offset 0, flags [DF], proto 6, length: 90) kckk.ru.smtp > c1.kckk.ru.33494: P 330:380(50) ack 88 win 5840
23:33:49.985952 IP (tos 0x0, ttl  64, id 20704, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 88:1548(1460) ack 380 win 6432
23:33:49.986627 IP (tos 0x0, ttl  64, id 20705, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 1548:3008(1460) ack 380 win 6432
23:33:50.285183 IP (tos 0x0, ttl  64, id 20706, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 88:1548(1460) ack 380 win 6432
23:33:50.305206 IP (tos 0x0, ttl  64, id 25145, offset 0, flags [DF], proto 6, length: 90) kckk.ru.smtp > c1.kckk.ru.33494: P 330:380(50) ack 88 win 5840
23:33:50.305301 IP (tos 0x0, ttl  64, id 20707, offset 0, flags [DF], proto 6, length: 52) c1.kckk.ru.33494 > kckk.ru.smtp: . [tcp sum ok] 3008:3008(0) ack 380 win 6432 <nop,nop,sack sack 1 {330:380} >
23:33:50.445165 IP (tos 0x0, ttl  64, id 25147, offset 0, flags [DF], proto 6, length: 40) kckk.ru.smtp > c1.kckk.ru.33494: . [tcp sum ok] 380:380(0) ack 1548 win 8760
23:33:50.445242 IP (tos 0x0, ttl  64, id 20708, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 1548:3008(1460) ack 380 win 6432
23:33:50.445566 IP (tos 0x0, ttl  64, id 20709, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 3008:4468(1460) ack 380 win 6432
23:33:51.045168 IP (tos 0x0, ttl  64, id 20710, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 1548:3008(1460) ack 380 win 6432
23:33:52.245169 IP (tos 0x0, ttl  64, id 20711, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 1548:3008(1460) ack 380 win 6432
23:33:54.645171 IP (tos 0x0, ttl  64, id 20712, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 1548:3008(1460) ack 380 win 6432
23:33:59.445168 IP (tos 0x0, ttl  64, id 20713, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 1548:3008(1460) ack 380 win 6432
23:34:09.045177 IP (tos 0x0, ttl  64, id 20714, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 1548:3008(1460) ack 380 win 6432
23:34:09.545164 IP (tos 0x0, ttl  64, id 25707, offset 0, flags [DF], proto 6, length: 40) kckk.ru.smtp > c1.kckk.ru.33494: . [tcp sum ok] 380:380(0) ack 3008 win 11680
23:34:09.545244 IP (tos 0x0, ttl  64, id 20715, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 3008:4468(1460) ack 380 win 6432
23:34:09.545993 IP (tos 0x0, ttl  64, id 20716, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 4468:5928(1460) ack 380 win 6432
23:34:10.035169 IP (tos 0x0, ttl  64, id 25714, offset 0, flags [DF], proto 6, length: 40) kckk.ru.smtp > c1.kckk.ru.33494: . [tcp sum ok] 380:380(0) ack 4468 win 14600
23:34:10.035292 IP (tos 0x0, ttl  64, id 20717, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: P 5928:7388(1460) ack 380 win 6432
23:34:10.036027 IP (tos 0x0, ttl  64, id 20718, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 7388:8848(1460) ack 380 win 6432
23:34:29.235166 IP (tos 0x0, ttl  64, id 20719, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 4468:5928(1460) ack 380 win 6432
23:34:29.685169 IP (tos 0x0, ttl  64, id 26430, offset 0, flags [DF], proto 6, length: 40) kckk.ru.smtp > c1.kckk.ru.33494: . [tcp sum ok] 380:380(0) ack 5928 win 17520
23:34:29.685248 IP (tos 0x0, ttl  64, id 20720, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: P 5928:7388(1460) ack 380 win 6432
23:34:29.685904 IP (tos 0x0, ttl  64, id 20721, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 7388:8848(1460) ack 380 win 6432
23:34:48.295182 IP (tos 0x0, ttl  64, id 30748, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33492 > kckk.ru.smtp: . 2592454566:2592456026(1460) ack 3911710755 win 6432
23:35:08.085168 IP (tos 0x0, ttl  64, id 20722, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: P 5928:7388(1460) ack 380 win 6432
23:35:08.585164 IP (tos 0x0, ttl  64, id 27365, offset 0, flags [DF], proto 6, length: 40) kckk.ru.smtp > c1.kckk.ru.33494: . [tcp sum ok] 380:380(0) ack 7388 win 20440
23:35:08.585243 IP (tos 0x0, ttl  64, id 20723, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 7388:8848(1460) ack 380 win 6432
23:35:08.585925 IP (tos 0x0, ttl  64, id 20724, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 8848:10308(1460) ack 380 win 6432
23:35:09.085153 IP (tos 0x0, ttl  64, id 27383, offset 0, flags [DF], proto 6, length: 40) kckk.ru.smtp > c1.kckk.ru.33494: . [tcp sum ok] 380:380(0) ack 8848 win 23360
23:35:09.085234 IP (tos 0x0, ttl  64, id 20725, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: P 10308:11768(1460) ack 380 win 6432
23:35:09.085990 IP (tos 0x0, ttl  64, id 20726, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: P 11768:13228(1460) ack 380 win 6432
23:36:25.885196 IP (tos 0x0, ttl  64, id 20727, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 8848:10308(1460) ack 380 win 6432
23:38:25.885170 IP (tos 0x0, ttl  64, id 20728, offset 0, flags [DF], proto 6, length: 1500) c1.kckk.ru.33494 > kckk.ru.smtp: . 8848:10308(1460) ack 380 win 6432


далее time-out