# tcpdump -i tun0 port 3389
tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back to cooked socket
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
10:38:35.501037 IP 10.8.0.58.50280 > 10.0.1.214.3389: S 3083535028:3083535028(0) win 8192 <mss 1368,nop,wscale 8,nop,nop,sackOK>
10:38:38.507344 IP 10.8.0.58.50280 > 10.0.1.214.3389: S 3083535028:3083535028(0) win 8192 <mss 1368,nop,wscale 8,nop,nop,sackOK>
10:38:44.512454 IP 10.8.0.58.50280 > 10.0.1.214.3389: S 3083535028:3083535028(0) win 8192 <mss 1368,nop,nop,sackOK>
10:39:15.406058 IP 10.8.0.58.50281 > 10.0.1.214.3389: S 172355802:172355802(0) win 8192 <mss 1368,nop,wscale 8,nop,nop,sackOK>
10:39:18.410701 IP 10.8.0.58.50281 > 10.0.1.214.3389: S 172355802:172355802(0) win 8192 <mss 1368,nop,wscale 8,nop,nop,sackOK>
10:39:24.416529 IP 10.8.0.58.50281 > 10.0.1.214.3389: S 172355802:172355802(0) win 8192 <mss 1368,nop,nop,sackOK>