Hello

I can't get this off my head so I hope someone is able to help me.

I have my localhost and an external server. I issue this command in my localhost:

sudo tcpdump host [hostfilter] and ! port 22 -i eth1 -venNt -s0

And this on my external server:

sudo tcpdump host [hostfilter] and ! port 22 -venNt -s0

So what I want is to see all the traffic between me and the external host except the traffic generated by ssh.

Then on my localcomp I issue a single-port scan like this:

sudo nmap -sS [exthost] -v -p23 -P0

And i get the results (shortened):

23/tcp closed telnet
Raw packets sent: 1 (44B) | Rcvd: 1 (46B)

Nmap states that it has sent 44bytes and received 46bytes. When I look my tcpdump outputs I see the following:

(mac- and ip-addresses replaced)

--first on my localhost--

--and my external server--

So basically my local computer (ipX) sends a tcp-syn-packet to my external server (ipY) to the port 23 and tcpdump says that the length is 44 bytes (agrees with nmap). Then the external server sends a rst-tcp-packet as a reply and the size(/length?) is 40 bytes. And this is the problem.

1) Why nmap tells me that it has received 46 bytes?
2) What are the six bytes?
3) How I can verify them in tcpdump output?

also why is the second ethernet frame 2bytes shorter (58vs60) ?

Help is really appreciated.