I eventually sometimes watch most initial tcp connection attempts like this:
tcpdump -nn -Z somepcapuser not src host (12x.x5.109.xxx or 62.75.160.xxx ) and not (port 9001 or 443 or 8080 ) and tcp[tcpflags]&(tcp-syn) !=0 and not tcp[tcpflags]& (tcp-ack) !=0 or icmp
this works pretty well to quickly identify oddness so far. However, I now have a question on the following output:
03:53:52.227884 IP 220.127.116.11.53786 > 62.75.160.xxx.80: S 846930886:846930886(0) win 61690 "<"mss 1460,nop,nop,sackOK,opt-178:f04700000000,nop,wscale 4">"
I wonder what the marked portion means, haven't seen that before.
Thanks for help wlaus