# tcpdump -i eth1 -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' [56/1876]
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode [55/1876]
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes [54/1876]
18:01:21.005758 IP 192.168.50.247.59444 > 192.168.254.254.http: Flags [P.], seq 670463000:670463186, ack 4286536286, win 1369, options [nop,nop,TS val 156886 ecr 2862355], length 186: HTTP: GET /generate_204 HTTP/1.1 [53/1876]
E.....@.?.v...2......4.P'.t...Z^...Yu...... [52/1876]
..d..+..GET /generate_204 HTTP/1.1 [51/1876]
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.0; SM-T710 Build/NRD90M) [50/1876]
Host: connectivitycheck.gstatic.com [49/1876]
Connection: Keep-Alive [48/1876]
Accept-Encoding: gzip [47/1876]
[46/1876]
[45/1876]
18:01:21.005885 IP 192.168.254.254.http > 192.168.50.247.59444: Flags [P.], seq 1:136, ack 186, win 235, options [nop,nop,TS val 2862356 ecr 156886], length 135: HTTP: HTTP/1.1 204 No Content [44/1876]
E...%.@.@.a.......2..P.4..Z^'.t............ [43/1876]
.+....d.HTTP/1.1 204 No Content [42/1876]
Server: nginx/1.19.2 [41/1876]
Date: Fri, 28 May 2021 15:01:21 GMT [40/1876]
Connection: keep-alive [39/1876]
Content-Type: text/html [38/1876]
[37/1876]
[36/1876]
18:01:22.086651 IP 192.168.50.247.59444 > 192.168.254.254.http: Flags [P.], seq 186:372, ack 136, win 1386, options [nop,nop,TS val 157102 ecr 2862356], length 186: HTTP: GET /generate_204 HTTP/1.1 [35/1876]
E.....@.?.v...2......4.P'.t...Z....js...... [34/1876]
..e..+..GET /generate_204 HTTP/1.1 [33/1876]
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.0; SM-T710 Build/NRD90M) [32/1876]
Host: connectivitycheck.gstatic.com [31/1876]
Connection: Keep-Alive [30/1876]
Accept-Encoding: gzip [29/1876]
[28/1876]
18:01:22.086774 IP 192.168.254.254.http > 192.168.50.247.59444: Flags [P.], seq 136:271, ack 372, win 243, options [nop,nop,TS val 2862626 ecr 157102], length 135: HTTP: HTTP/1.1 204 No Content
E...%.@.@.a.......2..P.4..Z.'.u............
.+."..e.HTTP/1.1 204 No Content
Server: nginx/1.19.2
Date: Fri, 28 May 2021 15:01:22 GMT
Connection: keep-alive
Content-Type: text/html
18:01:24.153866 IP 192.168.50.247.59444 > 192.168.254.254.http: Flags [P.], seq 372:558, ack 271, win 1403, options [nop,nop,TS val 157515 ecr 2862626], length 186: HTTP: GET /generate_204 HTTP/1.1
E.....@.?.v...2......4.P'.u...[l...{o......
..gK.+."GET /generate_204 HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.0; SM-T710 Build/NRD90M)
Host: connectivitycheck.gstatic.com
Connection: Keep-Alive
Accept-Encoding: gzip
18:01:24.154029 IP 192.168.254.254.http > 192.168.50.247.59444: Flags [P.], seq 271:406, ack 558, win 252, options [nop,nop,TS val 2863143 ecr 157515], length 135: HTTP: HTTP/1.1 204 No Content
E...%.@.@.a.......2..P.4..[l'.vF....~......
.+.'..gKHTTP/1.1 204 No Content
Server: nginx/1.19.2
Date: Fri, 28 May 2021 15:01:24 GMT
Connection: keep-alive
Content-Type: text/html