Вот лог утилиты tcpdump на интерфейсе ppp0
linux-n466:/home/serg # tcpdump -i ppp0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
13:28:07.753959 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [S], seq 464699443, win 5840, options [mss 1460,sackOK,TS val 4394188 ecr 0,nop,wscale 6], length 0
13:28:10.752081 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [S], seq 464699443, win 5840, options [mss 1460,sackOK,TS val 4394938 ecr 0,nop,wscale 6], length 0
13:28:13.284067 IP 81.177.31.194.pptp > 172.28.146.114.46660: Flags [S.], seq 3076866085, ack 464699444, win 5792, options [mss 1360,sackOK,TS val 1827934722 ecr 4394188,nop,wscale 6], length 0
13:28:13.284145 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [.], ack 1, win 92, options [nop,nop,TS val 4395571 ecr 1827934722], length 0
13:28:13.284830 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [P.], ack 1, win 92, options [nop,nop,TS val 4395571 ecr 1827934722], length 156: pptp CTRL_MSGTYPE=SCCRQ PROTO_VER(1.0) FRAME_CAP(AS) BEARER_CAP(DA) [|pptp]
13:28:14.780073 IP 81.177.31.194.pptp > 172.28.146.114.46660: Flags [S.], seq 3076866085, ack 464699444, win 5792, options [mss 1360,sackOK,TS val 1827937741 ecr 4394188,nop,wscale 6], length 0
13:28:14.780140 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [.], ack 1, win 92, options [nop,nop,TS val 4395945 ecr 1827937741,nop,nop,sack 1 {0:1}], length 0
13:28:15.084070 IP 81.177.31.194.pptp > 172.28.146.114.46660: Flags [S.], seq 3076866085, ack 464699444, win 5792, options [mss 1360,sackOK,TS val 1827938494 ecr 4394188,nop,wscale 6], length 0
13:28:15.084136 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [.], ack 1, win 92, options [nop,nop,TS val 4396021 ecr 1827938494,nop,nop,sack 1 {0:1}], length 0
13:28:17.984062 IP 81.177.31.194.pptp > 172.28.146.114.46660: Flags [.], ack 157, win 108, options [nop,nop,TS val 1827940549 ecr 4395571], length 0
13:28:18.020104 IP 81.177.31.194.pptp > 172.28.146.114.46660: Flags [P.], ack 157, win 108, options [nop,nop,TS val 1827940551 ecr 4395571], length 156: pptp CTRL_MSGTYPE=SCCRP PROTO_VER(1.0) RESULT_CODE(1) ERR_CODE(0) FRAME_CAP() BEARER_CAP() [|pptp]
13:28:18.020173 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [.], ack 157, win 108, options [nop,nop,TS val 4396755 ecr 1827940551], length 0
13:28:18.020433 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [P.], ack 157, win 108, options [nop,nop,TS val 4396755 ecr 1827940551], length 168: pptp CTRL_MSGTYPE=OCRQ CALL_ID(0) CALL_SER_NUM(0) MIN_BPS(2400) MAX_BPS(10000000) [|pptp]
13:28:22.704538 IP 81.177.31.194.pptp > 172.28.146.114.46660: Flags [P.], ack 325, win 124, options [nop,nop,TS val 1827945014 ecr 4396755], length 32: pptp CTRL_MSGTYPE=OCRP CALL_ID(53832) PEER_CALL_ID(0) RESULT_CODE(1) ERR_CODE(0) CAUSE_CODE(0) CONN_SPEED(10000000) [|pptp]
13:28:22.704980 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 1, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:22.705021 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 2, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:22.705035 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 3, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:22.705048 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 4, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:22.705061 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 5, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:22.705073 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 6, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:22.705084 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 7, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:22.744078 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [.], ack 189, win 108, options [nop,nop,TS val 4397936 ecr 1827945014], length 0
13:28:22.764143 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 8, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:24.764125 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 9, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:26.768120 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 10, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:28.768109 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 11, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:30.772110 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 12, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:32.772107 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 13, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:34.772101 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 14, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:36.772110 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 15, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:38.772126 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 16, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:40.772112 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 17, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:42.772111 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 18, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:44.776116 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 19, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:46.776116 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 20, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:48.781322 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 21, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:50.781338 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 22, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:52.781333 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 23, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:53.300258 IP 81.177.31.194.pptp > 172.28.146.114.46660: Flags [P.], ack 325, win 124, options [nop,nop,TS val 1827975293 ecr 4397936], length 148: pptp CTRL_MSGTYPE=CDN CALL_ID(53832) RESULT_CODE(3) ERR_CODE(0) CAUSE_CODE(0) [|pptp]
13:28:53.300328 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [.], ack 337, win 125, options [nop,nop,TS val 4405575 ecr 1827975293], length 0
13:28:54.784130 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 24, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:56.784123 IP 172.28.146.114 > 81.177.31.194: GREv1, call 53832, seq 25, length 26: LCP, Conf-Request (0x01), id 1, length 12
13:28:58.041389 IP 81.177.31.194.pptp > 172.28.146.114.46660: Flags [FP.], seq 337:353, ack 325, win 124, options [nop,nop,TS val 1827980298 ecr 4397936], length 16: pptp CTRL_MSGTYPE=StopCCRQ REASON(1)
13:28:58.041571 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [P.], ack 354, win 125, options [nop,nop,TS val 4406760 ecr 1827980298], length 16: pptp CTRL_MSGTYPE=StopCCRP RESULT_CODE(1) ERR_CODE(0)
13:28:58.041793 IP 172.28.146.114.46660 > 81.177.31.194.pptp: Flags [FP.], seq 341:357, ack 354, win 125, options [nop,nop,TS val 4406760 ecr 1827980298], length 16: pptp CTRL_MSGTYPE=CCRQ CALL_ID(0)
13:29:04.144104 IP 81.177.31.194.pptp > 172.28.146.114.46660: Flags [R], seq 3076866439, win 0, length 0
13:29:04.144173 IP 81.177.31.194.pptp > 172.28.146.114.46660: Flags [R], seq 3076866439, win 0, length 0
^C
47 packets captured
47 packets received by filter
0 packets dropped by kernel
linux-n466:/home/serg #