sudo tcpdump -n -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 96 bytes
01:52:21.253891 IP 10.5.227.28 > 77.88.21.8: ICMP echo request, id 512, seq 1280, length 40
01:52:26.349427 IP 10.5.227.28 > 77.88.21.8: ICMP echo request, id 512, seq 1536, length 40
01:52:31.850029 IP 10.5.227.28 > 77.88.21.8: ICMP echo request, id 512, seq 1792, length 40
01:52:36.883133 IP 10.5.227.28.2495 > 212.158.173.189.443: S 1628615224:1628615224(0) win 65535 <mss 1460,nop,nop,sackOK>
01:52:37.350608 IP 10.5.227.28 > 77.88.21.8: ICMP echo request, id 512, seq 2048, length 40
01:52:39.850853 IP 10.5.227.28.2495 > 212.158.173.189.443: S 1628615224:1628615224(0) win 65535 <mss 1460,nop,nop,sackOK>
01:52:45.867055 IP 10.5.227.28.2495 > 212.158.173.189.443: S 1628615224:1628615224(0) win 65535 <mss 1460,nop,nop,sackOK>