[root@home ~]# tcpdump -vv -i eth0 '!pppoes && !pppoed'
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
09:04:52.800994 arp who-has 192.168.1.1 tell 192.168.1.3
09:04:52.802032 arp reply 192.168.1.1 is-at 00:30:54:95:c5:dd (oui Unknown)
09:04:52.802062 IP (tos 0x0, ttl 64, id 22588, offset 0, flags [DF], proto TCP (6), length 60) 192.168.1.3.33871 > 192.168.1.1.http: S, cksum 0x5e4e (correct), 1593968600:1593968600(0) win 5840 <mss 1460,sackOK,timestamp 70279140 0,nop,wscale 6>
09:04:52.803882 IP (tos 0x0, ttl 64, id 51777, offset 0, flags [none], proto TCP (6), length 60) 192.168.1.1.http > 192.168.1.3.33871: S, cksum 0xf2db (correct), 2606754246:2606754246(0) ack 1593968601 win 17376 <mss 1460,nop,wscale 0,nop,nop,timestamp 179247 70279140>
09:04:52.803956 IP (tos 0x0, ttl 64, id 22589, offset 0, flags [DF], proto TCP (6), length 52) 192.168.1.3.33871 > 192.168.1.1.http: ., cksum 0x6220 (correct), 1:1(0) ack 1 win 92 <nop,nop,timestamp 70279144 179247>
09:04:52.804155 IP (tos 0x0, ttl 64, id 22590, offset 0, flags [DF], proto TCP (6), length 471) 192.168.1.3.33871 > 192.168.1.1.http: P 1:420(419) ack 1 win 92 <nop,nop,timestamp 70279144 179247>
09:04:53.007847 IP (tos 0x0, ttl 64, id 22591, offset 0, flags [DF], proto TCP (6), length 471) 192.168.1.3.33871 > 192.168.1.1.http: P 1:420(419) ack 1 win 92 <nop,nop,timestamp 70279348 179247>
09:04:53.415721 IP (tos 0x0, ttl 64, id 22592, offset 0, flags [DF], proto TCP (6), length 471) 192.168.1.3.33871 > 192.168.1.1.http: P 1:420(419) ack 1 win 92 <nop,nop,timestamp 70279756 179247>
09:04:54.231452 IP (tos 0x0, ttl 64, id 22593, offset 0, flags [DF], proto TCP (6), length 471) 192.168.1.3.33871 > 192.168.1.1.http: P 1:420(419) ack 1 win 92 <nop,nop,timestamp 70280572 179247>
09:04:55.862953 IP (tos 0x0, ttl 64, id 22594, offset 0, flags [DF], proto TCP (6), length 471) 192.168.1.3.33871 > 192.168.1.1.http: P 1:420(419) ack 1 win 92 <nop,nop,timestamp 70282204 179247>
09:04:59.125961 IP (tos 0x0, ttl 64, id 22595, offset 0, flags [DF], proto TCP (6), length 471) 192.168.1.3.33871 > 192.168.1.1.http: P 1:420(419) ack 1 win 92 <nop,nop,timestamp 70285468 179247>
09:05:05.651970 IP (tos 0x0, ttl 64, id 22596, offset 0, flags [DF], proto TCP (6), length 471) 192.168.1.3.33871 > 192.168.1.1.http: P 1:420(419) ack 1 win 92 <nop,nop,timestamp 70291996 179247>

12 packets captured
17 packets received by filter
0 packets dropped by kernel