hence my question on tcpdump