root@debian:~# tcpdump -i eth1 -n -nn -ttt 'dst host 10.254.254.3'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
00:00:00.000000 ARP, Request who-has 10.254.254.3 tell 10.254.254.1, length 46
00:00:00.001660 IP 10.130.8.100.52880 > 10.254.254.3.22: Flags [S], seq 2380805134, win 29200, options [mss 1460,sackOK,TS val 398060 ecr 0,nop,wscale 7], length 0
00:00:00.000676 IP 10.130.8.100.52880 > 10.254.254.3.22: Flags [.], ack 2126709918, win 229, options [nop,nop,TS val 398066 ecr 19343092], length 0
00:00:00.000078 IP 10.130.8.100.52880 > 10.254.254.3.22: Flags [P.], seq 0:41, ack 1, win 229, options [nop,nop,TS val 398066 ecr 19343092], length 41
00:00:00.007649 IP 10.130.8.100.52880 > 10.254.254.3.22: Flags [.], ack 40, win 229, options [nop,nop,TS val 398068 ecr 19343094], length 0
00:00:00.043968 IP 10.130.8.100.52880 > 10.254.254.3.22: Flags [.], ack 992, win 251, options [nop,nop,TS val 398078 ecr 19343094], length 0
00:00:00.179240 IP 10.130.8.100.52880 > 10.254.254.3.22: Flags [P.], seq 1377:1425, ack 992, win 251, options [nop,nop,TS val 398124 ecr 19343094], length 48
00:01:01.275904 ARP, Request who-has 10.254.254.3 tell 10.254.254.1, length 46