192.168.0.5.32772 > 192.168.0.3.42: S 3876367475:3876367475(0) win 5840 <mss 1460,sackOK,timestamp 10426325 0,nop,wscale 0> (DF) 192.168.0.5.32774 > 192.168.0.3.196: S 3902950029:3902950029(0) win 5840 <mss 1460,sackOK,timestamp 10434715 0,nop,wscale 0> (DF) 192.168.0.5.32773 > 192.168.0.3.69: S 3883917621:3883917621(0) win 5840 <mss 1460,sackOK,timestamp 10431805 0,nop,wscale 0> (DF)
Example 2: Intercepted knocks.