делал и так.вот если поможет результат tcpdump
tcpdump -i ed0 host lst
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ed0, link-type EN10MB (Ethernet), capture size 96 bytes
00:13:28.677786 IP lst.49426 > pop.mail.ru.pop3: S 2217574169:2217574169(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
00:13:31.673533 IP lst.49426 > pop.mail.ru.pop3: S 2217574169:2217574169(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
00:13:37.669493 IP lst.49426 > pop.mail.ru.pop3: S 2217574169:2217574169(0) win 8192 <mss 1460,nop,nop,sackOK>
^C
3 packets captured
88 packets received by filter
0 packets dropped by kernel