best viewed with tcpdump