[root@vm1000 ~]# tcpdump -i ens32 port 389
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens32, link-type EN10MB (Ethernet), capture size 262144 bytes
16:28:02.668058 IP pauline-mkt.mailgw.com.41948 > srvleon.mailgw.com.ldap: Flags [S], seq 2414468076, win 29200, options [mss 1460,sackOK,TS val 800294598 ecr 0,nop,wscale 7], length 0
16:28:02.668903 IP srvleon.mailgw.com.ldap > pauline-mkt.mailgw.com.41948: Flags [S.], seq 2723246614, ack 2414468077, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 476285837 ecr 800294598], length 0
16:28:02.668943 IP pauline-mkt.mailgw.com.41948 > srvleon.mailgw.com.ldap: Flags [.], ack 1, win 229, options [nop,nop,TS val 800294599 ecr 476285837], length 0
16:28:02.669954 IP pauline-mkt.mailgw.com.41948 > srvleon.mailgw.com.ldap: Flags [P.], seq 1:58, ack 1, win 229, options [nop,nop,TS val 800294600 ecr 476285837], length 57
16:28:02.674297 IP srvleon.mailgw.com.ldap > pauline-mkt.mailgw.com.41948: Flags [P.], seq 1:23, ack 58, win 260, options [nop,nop,TS val 476285837 ecr 800294600], length 22
16:28:02.674431 IP pauline-mkt.mailgw.com.41948 > srvleon.mailgw.com.ldap: Flags [.], ack 23, win 229, options [nop,nop,TS val 800294605 ecr 476285837], length 0