Listing 5 Partial trace taken on Spy1 showing the ARP frames (tcpdump -eSv)

#7
16:56:53.614674 0:e0:1e:60:8e:c7 0:50:bf:16:ba:ae ip 70: \
Top.1064 > RoadRunner.2080: P [tcp sum ok] 2346664987:2346664991(4) \
ack 384981432 win 5840 <nop,nop,timestamp 16603337 2052934> (DF) \
[tos 0x10]  (ttl 63, id 20445, len 56)

16:56:53.804674 0:50:bf:16:ba:ae Broadcast arp 60: arp who-has \
192.168.1.99 tell RoadRunner

16:56:53.804674 0:50:bf:2e:1e:56 0:50:bf:16:ba:ae arp 42: arp reply \
192.168.1.99 is-at 0:50:bf:2e:1e:56

#8
16:56:53.804674 0:50:bf:16:ba:ae 0:50:bf:2e:1e:56 ip 66: \
RoadRunner.2080 > Top.1064: . [tcp sum ok] ack 2346664991 win 17385 \
<nop,nop,timestamp 2054280 16603337> (DF) (ttl 128, id 53567, len 52)
#9
16:56:53.804674 0:50:bf:2e:1e:56 0:50:bf:16:ba:ae ip 54: \
Top.1064 > RoadRunner.2080: R [tcp sum ok] 2346664991:2346664991(0) \
win 0 (DF) (ttl 255, id 0, len 40)

16:56:53.804674 0:e0:1e:60:8e:c7 0:50:bf:16:ba:ae arp 60: arp reply \
192.168.1.99 is-at 0:e0:1e:60:8e:c7

#10
16:56:54.034674 0:e0:1e:60:8e:c7 0:50:bf:16:ba:ae ip 70: \
Top.1064 > RoadRunner.2080: P [tcp sum ok] 2346664987:2346664991(4) \
ack 384981432 win 5840 <nop,nop,timestamp 16603380 2052934> (DF) \
[tos 0x10]  (ttl 63, id 20446, len 56)
#11
16:56:54.044674 0:50:bf:16:ba:ae 0:e0:1e:60:8e:c7 ip 60: \
RoadRunner.2080 > Top.1064: R [tcp sum ok] 384981432:384981432(0) \
win 0 (ttl 128, id 53568, len 40)