vyos@vyos:~$ sudo tcpdump not icmp and not stp and not arp and not port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:54:32.740444 IP 192.168.137.130.5880 > 192.168.25.4.isakmp: isakmp: phase 1 I ident
09:54:32.742414 IP 192.168.25.4.isakmp > 192.168.137.130.5880: isakmp: phase 1 R ident
09:54:34.380260 IP 192.168.137.130.5880 > 192.168.25.4.isakmp: isakmp: phase 1 I ident
09:54:34.389735 IP 192.168.25.4.isakmp > 192.168.137.130.5880: isakmp: phase 1 R ident
09:54:34.575520 IP 192.168.137.130.4500 > 192.168.25.4.4500: NONESP-encap: isakmp: phase 1 I ident[E]
09:54:34.576320 IP 192.168.25.4.4500 > 192.168.137.130.4500: NONESP-encap: isakmp: phase 1 R ident[E]
09:54:34.690678 IP 192.168.137.130.4500 > 192.168.25.4.4500: NONESP-encap: isakmp: phase 2/others I inf[E]
09:54:34.700475 IP 192.168.137.130.4500 > 192.168.25.4.4500: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]
09:54:34.701208 IP 192.168.25.4.4500 > 192.168.137.130.4500: NONESP-encap: isakmp: phase 2/others R inf[E]
09:54:49.894434 IP 192.168.137.130.4500 > 192.168.25.4.4500: isakmp-nat-keep-alive
09:54:54.716791 IP 192.168.25.4.4500 > 192.168.137.130.4500: isakmp-nat-keep-alive
09:54:54.844233 IP 192.168.137.130.4500 > 192.168.25.4.4500: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]
09:54:54.845012 IP 192.168.25.4.4500 > 192.168.137.130.4500: NONESP-encap: isakmp: phase 2/others R inf[E]
09:55:06.524330 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp:TLSNs=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *HOST_NAME(anonymous) *FRAMING_CAP(AS) *ASSND_TUN_ID(40584) *RECV_WIN_SIZE(1)
09:55:08.449370 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp:TLSNs=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *HOST_NAME(anonymous) *FRAMING_CAP(AS) *ASSND_TUN_ID(40584) *RECV_WIN_SIZE(1)
09:55:08.524843 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=0,Nr=1 *MSGTYPE(SCCRP) *PROTO_VER(1.0) *FRAMING_CAP(AS) *BEARER_CAP() *FIRM_VER(1680) *HOST_NAME(vyos) *VENDOR_NAME(xelerance.com) *ASSND_TUN_ID(59358) *RECV_WIN_SIZE(4)
09:55:08.525094 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=0,Nr=1 ZLB
09:55:08.643429 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp:TLSNs=1,Nr=1 *MSGTYPE(SCCCN)
09:55:08.643579 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=1,Nr=2 ZLB
09:55:08.763931 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp:TLSNs=2,Nr=1 *MSGTYPE(ICRQ) *ASSND_SESS_ID(12425) *CALL_SER_NUM(3121273184)
09:55:08.764115 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=1,Nr=3 *MSGTYPE(ICRP) *ASSND_SESS_ID(34057)
09:55:08.764207 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=2,Nr=3 ZLB
09:55:08.878662 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp:TLSNs=3,Nr=2 *MSGTYPE(ICCN) *TX_CONN_SPEED(100000000) *FRAMING_TYPE(AS)
09:55:08.880390 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=2,Nr=4 ZLB
09:55:08.887736 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {LCP, Conf-Request (0x01), id 1, length 30}
09:55:08.999667 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {LCP, Conf-Request (0x01), id 1, length 26}
09:55:08.999708 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {LCP, Conf-Nack (0x03), id 1, length 11}
09:55:09.000448 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {LCP, Conf-Ack (0x02), id 1, length 26}
09:55:09.000541 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {LCP, Conf-Request (0x01), id 2, length 31}
09:55:09.118371 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {LCP, Conf-Ack (0x02), id 2, length 31}
09:55:09.119610 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {CHAP, Challenge (0x01), id 210, Value e2ab70d2e7e2b7dcdfc71a311cf190cf97, Name xl2tpd}
09:55:09.240611 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {CHAP, Response (0x02), id 210, Value 12e44a04a0de00120cefd9f8a5860c13, Name user}
09:55:09.241419 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {CHAP, Success (0x03), id 210, Msg Access granted}
09:55:09.241524 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {IPCP, Conf-Request (0x01), id 1, length 18}
09:55:09.358619 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {unknown ctrl-proto (0x80fd), Conf-Request (0x01), id 1, length 17}
09:55:09.359139 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {LCP, Prot-Reject (0x08), id 3, length 23}
09:55:09.363649 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {IPCP, Conf-Request (0x01), id 1, length 30}
09:55:09.364006 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {IPCP, Conf-Reject (0x04), id 1, length 18}
09:55:09.368349 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {IPCP, Conf-Ack (0x02), id 1, length 18}
09:55:09.473900 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {IPCP, Conf-Request (0x01), id 2, length 18}
09:55:09.474338 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {IPCP, Conf-Nack (0x03), id 2, length 12}
09:55:09.588676 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {IPCP, Conf-Request (0x01), id 3, length 18}
09:55:09.590121 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {IPCP, Conf-Ack (0x02), id 3, length 18}
09:55:14.865353 IP 192.168.25.4.4500 > 192.168.137.130.4500: isakmp-nat-keep-alive
09:55:16.848611 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {IP 192.168.1.12 > 124.215.201.23: ICMP 192.168.1.12 udp port 4500 unreachable, length 37}
09:55:20.412770 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp: {LCP, Term-Request (0x05), id 2, length 18}
09:55:20.417406 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:L {LCP, Term-Ack (0x06), id 2, length 6}
09:55:20.777845 IP 192.168.137.130.40411 > 192.168.25.4.l2f: l2tp:TLSNs=4,Nr=2 *MSGTYPE(StopCCN) *ASSND_TUN_ID(40584) *RESULT_CODE(6)
09:55:20.778135 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=2,Nr=5 ZLB
09:55:20.778240 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=2,Nr=5 *MSGTYPE(StopCCN) *ASSND_TUN_ID(59358) *RESULT_CODE(2/2 Result Code: expected at least 10, got 8)
09:55:21.780902 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=2,Nr=5 *MSGTYPE(StopCCN) *ASSND_TUN_ID(59358) *RESULT_CODE(2/2 Result Code: expected at least 10, got 8)
09:55:22.782069 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=2,Nr=5 *MSGTYPE(StopCCN) *ASSND_TUN_ID(59358) *RESULT_CODE(2/2 Result Code: expected at least 10, got 8)
09:55:23.783217 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=2,Nr=5 *MSGTYPE(StopCCN) *ASSND_TUN_ID(59358) *RESULT_CODE(2/2 Result Code: expected at least 10, got 8)
09:55:24.784373 IP 192.168.25.4.l2f > 192.168.137.130.40411: l2tp:TLSNs=2,Nr=5 *MSGTYPE(StopCCN) *ASSND_TUN_ID(59358) *RESULT_CODE(2/2 Result Code: expected at least 10, got 8)