Code: Select all
tcpdump -p -n -i <interface> -X -s0 -w capturefile.pcap host <ip address>
Yeah, it's almost certainly the re-use of the source port which is causing it. Since the EVL never dropped the connection, seeing a SYN on what it considers an already established connection is confusing it. I don't think this is specific to the EVL/TPI, I'd expect a hung connection as a possibility on any TCP server this happens to.