NAT box dump

16:29:48.720290 IP (tos 0x0, ttl 64, id 56175, offset 0, flags [DF], proto TCP (6), length 60)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [S], cksum 0x4e27 (correct), seq 573961269, win 28400, options [mss 1420,sackOK,TS val 152579930 ecr 0,nop,wscale 7], length 0
16:29:49.733990 IP (tos 0x0, ttl 64, id 56176, offset 0, flags [DF], proto TCP (6), length 60)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [S], cksum 0x4d29 (correct), seq 573961269, win 28400, options [mss 1420,sackOK,TS val 152580184 ecr 0,nop,wscale 7], length 0
16:29:51.749992 IP (tos 0x0, ttl 64, id 56177, offset 0, flags [DF], proto TCP (6), length 60)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [S], cksum 0x4b31 (correct), seq 573961269, win 28400, options [mss 1420,sackOK,TS val 152580688 ecr 0,nop,wscale 7], length 0
16:29:55.782020 IP (tos 0x0, ttl 64, id 56178, offset 0, flags [DF], proto TCP (6), length 60)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [S], cksum 0x4741 (correct), seq 573961269, win 28400, options [mss 1420,sackOK,TS val 152581696 ecr 0,nop,wscale 7], length 0
16:30:03.974766 IP (tos 0x0, ttl 64, id 56179, offset 0, flags [DF], proto TCP (6), length 60)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [S], cksum 0x3f41 (correct), seq 573961269, win 28400, options [mss 1420,sackOK,TS val 152583744 ecr 0,nop,wscale 7], length 0
16:30:20.102872 IP (tos 0x0, ttl 64, id 56180, offset 0, flags [DF], proto TCP (6), length 60)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [S], cksum 0x2f81 (correct), seq 573961269, win 28400, options [mss 1420,sackOK,TS val 152587776 ecr 0,nop,wscale 7], length 0
16:30:52.870681 IP (tos 0x0, ttl 64, id 56181, offset 0, flags [DF], proto TCP (6), length 60)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [S], cksum 0x0f81 (correct), seq 573961269, win 28400, options [mss 1420,sackOK,TS val 152595968 ecr 0,nop,wscale 7], length 0
16:30:52.889141 IP (tos 0x0, ttl 64, id 56182, offset 0, flags [DF], proto TCP (6), length 52)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [.], cksum 0x114c (correct), seq 573961270, ack 890124577, win 222, options [nop,nop,TS val 152595972 ecr 830405417], length 0
16:30:52.897515 IP (tos 0x0, ttl 64, id 56183, offset 0, flags [DF], proto TCP (6), length 569)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [P.], cksum 0xa05e (correct), seq 0:517, ack 1, win 222, options [nop,nop,TS val 152595974 ecr 830405417], length 517
16:30:52.916316 IP (tos 0x0, ttl 64, id 56184, offset 0, flags [DF], proto TCP (6), length 52)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [.], cksum 0xfc2a (correct), seq 517, ack 4804, win 297, options [nop,nop,TS val 152595979 ecr 830405424], length 0
16:30:52.917892 IP (tos 0x0, ttl 64, id 56185, offset 0, flags [DF], proto TCP (6), length 243)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [P.], cksum 0xba3d (correct), seq 517:708, ack 4804, win 297, options [nop,nop,TS val 152595980 ecr 830405424], length 191
16:30:52.935727 IP (tos 0x0, ttl 64, id 56186, offset 0, flags [DF], proto TCP (6), length 219)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [P.], cksum 0xb9a1 (correct), seq 708:875, ack 4855, win 297, options [nop,nop,TS val 152595984 ecr 830405429], length 167
16:30:52.956694 IP (tos 0x0, ttl 64, id 56187, offset 0, flags [DF], proto TCP (6), length 83)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [P.], cksum 0x6e90 (correct), seq 875:906, ack 5246, win 319, options [nop,nop,TS val 152595989 ecr 830405434], length 31
16:30:52.958531 IP (tos 0x0, ttl 64, id 56188, offset 0, flags [DF], proto TCP (6), length 52)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [F.], cksum 0xf8bf (correct), seq 906, ack 5246, win 319, options [nop,nop,TS val 152595990 ecr 830405434], length 0
16:30:52.974026 IP (tos 0x0, ttl 64, id 56189, offset 0, flags [DF], proto TCP (6), length 52)
    10.156.0.23.56856 > Y.Y.Y.Y.443: Flags [.], cksum 0xf8b5 (correct), seq 907, ack 5247, win 319, options [nop,nop,TS val 152595994 ecr 830405439], length 0