192.168.3.8     pocitac na vnitrni siti
185.100.196.77  Ezechiel venkovni IP 
217.195.162.4   www.panska.cz

pocitac 192.168.3.8   posila paket na www.panska.cz, port 80
  na vnitrni siti v Kobylisich ramec s timto paketem dostane MAC adresu Ezchiela
    - to je default gateway
  diky teto MAC adrese doputuje paket z vnitrni site Ezechielovi ,
    i kdyz tento paket ma destination IP 217.195.162.4


dale mame vystup z programu  tcpdump 
jsou zde dany dohromady dve rozhrani, u radku je napsano   uvnitr  a venku 

port - cislicko za posledni teckou 
a posilame dotaz na www.panska.cz
     vidime jenom uplny uvod, pro ukazku NATu 

uvnitr    21:36:01.295509 IP 192.168.3.8.60211 > 217.195.162.4.80:     Flags [S], seq 134181838, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
venku     21:36:01.295526 IP 185.100.196.77.60211 > 217.195.162.4.80:  Flags [S], seq 134181838, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
venku     21:36:01.298037 IP 217.195.162.4.80 > 185.100.196.77.60211:  Flags [S.], seq 180095529, ack 134181839, win 64240, options [mss 1412,nop,nop,sackOK,nop,wscale 7], length 0
uvnitr    21:36:01.298044 IP 217.195.162.4.80 > 192.168.3.8.60211:     Flags [S.], seq 180095529, ack 134181839, win 64240, options [mss 1412,nop,nop,sackOK,nop,wscale 7], length 0

nedeste se, ze length je  0 , tohle jsou uplne uvodni pakety pro TCP  
  



tady dal mate samostatne tcpdump pro vnitrni i vnejsi rozhrani
   nahore je to pak poskladano podle casu poslani 
   

vnitrni 
21:36:01.295509 IP 192.168.3.8.60211 > 217.195.162.4.80: Flags [S], seq 134181838, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:36:01.298044 IP 217.195.162.4.80 > 192.168.3.8.60211: Flags [S.], seq 180095529, ack 134181839, win 64240, options [mss 1412,nop,nop,sackOK,nop,wscale 7], length 0
21:36:01.298176 IP 192.168.3.8.60211 > 217.195.162.4.80: Flags [.], ack 1, win 1025, length 0


Vnejsi 
21:36:01.295526 IP 185.100.196.77.60211 > 217.195.162.4.80: Flags [S], seq 134181838, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:36:01.298037 IP 217.195.162.4.80 > 185.100.196.77.60211: Flags [S.], seq 180095529, ack 134181839, win 64240, options [mss 1412,nop,nop,sackOK,nop,wscale 7], length 0
21:36:01.298189 IP 185.100.196.77.60211 > 217.195.162.4.80: Flags [.], ack 1, win 1025, length 0
21:36:06.791090 IP 185.100.196.77.60211 > 217.195.162.4.80: Flags [F.], seq 1, ack 1, win 1025, length 0
21:36:06.794904 IP 217.195.162.4.80 > 185.100.196.77.60211: Flags [F.], seq 1, ack 2, win 502, length 0
21:36:06.795102 IP 185.100.196.77.60211 > 217.195.162.4.80: Flags [.], ack 2, win 1025, length 0