Apparently I cut my the last post too short to be useful. I am getting better at tcpdump. Here is everything I captured the last time I tried:
Capture command: tcpdump -s 0 -w /opt/mail/dump11.txt net 208.75.76.252/32 root@server:~ $ tcpdump -AKvvr /opt/mail/dump12.txt reading from file /opt/mail/dump12.txt, link-type EN10MB (Ethernet) 19:27:28.397765 IP (tos 0x0, ttl 46, id 18783, offset 0, flags [DF], proto TCP (6), length 52) mx-ecom.netflix.com.61142 > server.workflowproducts.com.smtp: Flags [S], seq 1953720321, win 5840, options [mss 1380,nop,nop,sackOK,nop,wscale 7], length 0 e.....@....p.kl...,.....tsh..........8.....d........ 19:27:28.397838 IP (tos 0x0, ttl 64, id 3095, offset 0, flags [DF], proto TCP (6), length 52) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61142: Flags [S.], seq 1089115808, ack 1953720322, win 65535, options [mss 1460,nop,wscale 6,sackOK,eol], length 0 E..4..@.@.....,..kl.....@...tsh..... ............... 19:27:28.483630 IP (tos 0x0, ttl 46, id 18784, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.61142 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 1, win 46, length 0 E..(I`@....{.KL...,.....tsh.@...P...........^. 19:27:28.483709 IP (tos 0x0, ttl 64, id 22785, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61142: Flags [.], seq 1, ack 1, win 58240, length 0 E..(Y.@.@.....,..kl.....@...tsh.P... ... 19:27:28.558695 IP (tos 0x0, ttl 64, id 32537, offset 0, flags [DF], proto TCP (6), length 86) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61142: Flags [.], seq 1:47, ack 1, win 58240, length 46 E..V..@.@.....,..kl.....@...tsh.P... =..220 server.workflowproducts.com ESMTP Postfix 19:27:28.644317 IP (tos 0x0, ttl 46, id 18785, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.61142 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 47, win 46, length 0 E..(i...@....z.kl...,.....tsh.@...P..........l8. 19:27:28.644376 IP (tos 0x0, ttl 64, id 20283, offset 0, flags [DF], proto TCP (6), length 41) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61142: Flags [P.], seq 47:48, ack 1, win 58240, length 1 E..)O;@.@.....,..kl.....@...tsh.P... ... 19:27:28.730064 IP (tos 0x0, ttl 46, id 18786, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.61142 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 48, win 46, length 0 E..(i...@....y.kl...,.....tsh.@...P..........s.. 19:27:59.156177 IP (tos 0x0, ttl 46, id 18787, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.61142 > server.workflowproducts.com.smtp: Flags [F.], seq 1, ack 48, win 46, length 0 E..(i...@....x.kl...,.....tsh.@...P.........G..Y 19:27:59.156254 IP (tos 0x0, ttl 64, id 39873, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61142: Flags [.], seq 48, ack 2, win 58240, length 0 E..(..@.@.....,..kl.....@...tsh.P... ... 19:27:59.156688 IP (tos 0x0, ttl 46, id 8554, offset 0, flags [DF], proto TCP (6), length 52) mx-ecom.netflix.com.63556 > server.workflowproducts.com.smtp: Flags [S], seq 1780206462, win 5840, options [mss 1380,nop,nop,sackOK,nop,wscale 7], length 0 E..4!j@...!f.KL...,..D..j..~........ ......d........ 19:27:59.156758 IP (tos 0x0, ttl 64, id 58828, offset 0, flags [DF], proto TCP (6), length 52) server.workflowproducts.com.smtp > mx-ecom.netflix.com.63556: Flags [S.], seq 2026914080, ack 1780206463, win 65535, options [mss 1460,nop,wscale 6,sackOK,eol], length 0 E..4..@.@.....,..KL....Dx.A j....... ............... 19:27:59.157941 IP (tos 0x0, ttl 64, id 50338, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61142: Flags [F.], seq 48, ack 2, win 58240, length 0 E..(..@.@.....,..kl.....@...tsh.P... ... 19:27:59.246520 IP (tos 0x0, ttl 46, id 0, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.61142 > server.workflowproducts.com.smtp: Flags [.], seq 2, ack 49, win 46, length 0 E..(..@...B..KL...,.....tsh.@...P......... ... 19:27:59.246815 IP (tos 0x0, ttl 46, id 8555, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.63556 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 1, win 46, length 0 E..(!k@...!q.KL...,..D..j...x.A!P............. 19:27:59.246853 IP (tos 0x0, ttl 64, id 33230, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.63556: Flags [.], seq 1, ack 1, win 58240, length 0 E..(..@.@.....,..KL....Dx.A!j...P... ... 19:27:59.250271 IP (tos 0x0, ttl 64, id 39391, offset 0, flags [DF], proto TCP (6), length 86) server.workflowproducts.com.smtp > mx-ecom.netflix.com.63556: Flags [.], seq 1:47, ack 1, win 58240, length 46 E..V..@.@.....,..KL....Dx.A!j...P... =..220 server.workflowproducts.com ESMTP Postfix 19:27:59.338459 IP (tos 0x0, ttl 46, id 8556, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.63556 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 47, win 46, length 0 E..(!l@...!p.KL...,..D..j...x.AOP.........4..l 19:27:59.338510 IP (tos 0x0, ttl 64, id 60544, offset 0, flags [DF], proto TCP (6), length 41) server.workflowproducts.com.smtp > mx-ecom.netflix.com.63556: Flags [P.], seq 47:48, ack 1, win 58240, length 1 E..)..@.@.....,..KL....Dx.AOj...P... ... 19:27:59.425737 IP (tos 0x0, ttl 46, id 8557, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.63556 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 48, win 46, length 0 E..(!m@...!o.KL...,..D..j...x.APP.........9..] 19:29:00.383028 IP (tos 0x0, ttl 46, id 8558, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.63556 > server.workflowproducts.com.smtp: Flags [F.], seq 1, ack 48, win 46, length 0 E..(!n@...!n.KL...,..D..j...x.APP...........0. 19:29:00.383121 IP (tos 0x0, ttl 64, id 9980, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.63556: Flags [.], seq 48, ack 2, win 58240, length 0 E..(&.@.@.....,..KL....Dx.APj...P... ... 19:29:00.384198 IP (tos 0x0, ttl 46, id 12858, offset 0, flags [DF], proto TCP (6), length 52) mx-ecom.netflix.com.42039 > server.workflowproducts.com.smtp: Flags [S], seq 1096371055, win 5840, options [mss 1380,nop,nop,sackOK,nop,wscale 7], length 0 E..42:@......KL...,..7..AYKo...............d........ 19:29:00.384237 IP (tos 0x0, ttl 64, id 39063, offset 0, flags [DF], proto TCP (6), length 52) server.workflowproducts.com.smtp > mx-ecom.netflix.com.42039: Flags [S.], seq 1569898486, ack 1096371056, win 65535, options [mss 1460,nop,wscale 6,sackOK,eol], length 0 E..4..@.@.....,..KL....7]...AYKp.... ............... 19:29:00.384431 IP (tos 0x0, ttl 64, id 49855, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.63556: Flags [F.], seq 48, ack 2, win 58240, length 0 E..(..@.@.....,..KL....Dx.APj...P... ... 19:29:00.474464 IP (tos 0x0, ttl 46, id 0, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.63556 > server.workflowproducts.com.smtp: Flags [.], seq 2, ack 49, win 46, length 0 E..(..@...B..KL...,..D..j...x.AQP.........5.3. 19:29:00.474853 IP (tos 0x0, ttl 46, id 12859, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.42039 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 1, win 46, length 0 E..(2;@......KL...,..7..AYKp]...P...W.....&..J 19:29:00.474929 IP (tos 0x0, ttl 64, id 56305, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.42039: Flags [.], seq 1, ack 1, win 58240, length 0 E..(..@.@.....,..KL....7]...AYKpP... ... 19:29:00.477964 IP (tos 0x0, ttl 64, id 47852, offset 0, flags [DF], proto TCP (6), length 86) server.workflowproducts.com.smtp > mx-ecom.netflix.com.42039: Flags [.], seq 1:47, ack 1, win 58240, length 46 E..V..@.@.....,..KL....7]...AYKpP... =..220 server.workflowproducts.com ESMTP Postfix 19:29:00.568682 IP (tos 0x0, ttl 46, id 12860, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.42039 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 47, win 46, length 0 E..(2<@......KL...,..7..AYKp]..%P...V.......,- 19:29:00.568756 IP (tos 0x0, ttl 64, id 9667, offset 0, flags [DF], proto TCP (6), length 41) server.workflowproducts.com.smtp > mx-ecom.netflix.com.42039: Flags [P.], seq 47:48, ack 1, win 58240, length 1 E..)%.@.@.....,..KL....7]..%AYKpP... ... 19:29:00.655916 IP (tos 0x0, ttl 46, id 12861, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.42039 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 48, win 46, length 0 E..(2=@......KL...,..7..AYKp]..&P...V.....K.5. 19:31:01.054452 IP (tos 0x0, ttl 46, id 12862, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.42039 > server.workflowproducts.com.smtp: Flags [F.], seq 1, ack 48, win 46, length 0 E..(2>@......KL...,..7..AYKp]..&P...V..... M.. 19:31:01.054486 IP (tos 0x0, ttl 64, id 46655, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.42039: Flags [.], seq 48, ack 2, win 58240, length 0 E..(.?@.@.....,..KL....7]..&AYKqP... ... 19:31:01.055751 IP (tos 0x0, ttl 46, id 16448, offset 0, flags [DF], proto TCP (6), length 52) mx-ecom.netflix.com.61073 > server.workflowproducts.com.smtp: Flags [S], seq 1943919507, win 5840, options [mss 1380,nop,nop,sackOK,nop,wscale 7], length 0 E..4@@@......KL...,.....s..................d........ 19:31:01.055786 IP (tos 0x0, ttl 64, id 6235, offset 0, flags [DF], proto TCP (6), length 52) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61073: Flags [S.], seq 353483927, ack 1943919508, win 65535, options [mss 1460,nop,wscale 6,sackOK,eol], length 0 E..4.[@.@.....,..KL.........s....... ............... 19:31:01.055828 IP (tos 0x0, ttl 64, id 10076, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.42039: Flags [F.], seq 48, ack 2, win 58240, length 0 E..('\@.@.....,..KL....7]..&AYKqP... ... 19:31:01.147442 IP (tos 0x0, ttl 46, id 16449, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.61073 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 1, win 46, length 0 E..(@a...@......kl...,.....s.......P..........~.. 19:31:01.147524 IP (tos 0x0, ttl 64, id 29986, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61073: Flags [.], seq 1, ack 1, win 58240, length 0 E..(u"@.@.....,..KL.........s...P... ... 19:31:01.147652 IP (tos 0x0, ttl 46, id 0, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.42039 > server.workflowproducts.com.smtp: Flags [.], seq 2, ack 49, win 46, length 0 E..(..@...B..KL...,..7..AYKq]..'P...V......... 19:31:01.152013 IP (tos 0x0, ttl 64, id 41996, offset 0, flags [DF], proto TCP (6), length 86) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61073: Flags [.], seq 1:47, ack 1, win 58240, length 46 E..V..@.@.....,..KL.........s...P... =..220 server.workflowproducts.com ESMTP Postfix 19:31:01.239447 IP (tos 0x0, ttl 46, id 16450, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.61073 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 47, win 46, length 0 E..(@b...@......kl...,.....s.......P.........)e.B 19:31:01.239518 IP (tos 0x0, ttl 64, id 60461, offset 0, flags [DF], proto TCP (6), length 41) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61073: Flags [P.], seq 47:48, ack 1, win 58240, length 1 E..).-@.@.....,..KL.........s...P... ... 19:31:01.329766 IP (tos 0x0, ttl 46, id 16451, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.61073 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 48, win 46, length 0 E..(@c...@......kl...,.....s.......P.........5.#- 19:31:32.160830 IP (tos 0x0, ttl 46, id 16452, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.61073 > server.workflowproducts.com.smtp: Flags [F.], seq 1, ack 48, win 46, length 0 E..(@d...@......kl...,.....s.......P.........h... 19:31:32.160912 IP (tos 0x0, ttl 64, id 8652, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61073: Flags [.], seq 48, ack 2, win 58240, length 0 E..(!.@.@.....,..KL.........s...P... ... 19:31:32.161336 IP (tos 0x0, ttl 46, id 7125, offset 0, flags [DF], proto TCP (6), length 52) mx-ecom.netflix.com.16090 > server.workflowproducts.com.smtp: Flags [S], seq 303587140, win 5840, options [mss 1380,nop,nop,sackOK,nop,wscale 7], length 0 E..4..@...&..KL...,.>....._D.........M.....d........ 19:31:32.161404 IP (tos 0x0, ttl 64, id 46807, offset 0, flags [DF], proto TCP (6), length 52) server.workflowproducts.com.smtp > mx-ecom.netflix.com.16090: Flags [S.], seq 1037803240, ack 303587141, win 65535, options [mss 1460,nop,wscale 6,sackOK,eol], length 0 E..4..@.@.....,..KL...>.=....._E.... ............... 19:31:32.162375 IP (tos 0x0, ttl 64, id 63467, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.61073: Flags [F.], seq 48, ack 2, win 58240, length 0 E..(..@.@.....,..KL.........s...P... ... 19:31:32.254107 IP (tos 0x0, ttl 46, id 7126, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.16090 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 1, win 46, length 0 E..(..@...'..KL...,.>....._E=...P............, 19:31:32.254174 IP (tos 0x0, ttl 64, id 13556, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.16090: Flags [.], seq 1, ack 1, win 58240, length 0 E..(4.@.@.....,..KL...>.=....._EP... ... 19:31:32.254352 IP (tos 0x0, ttl 46, id 0, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.61073 > server.workflowproducts.com.smtp: Flags [.], seq 2, ack 49, win 46, length 0 E..(..@...B..KL...,.....s.......P..........#.u 19:31:32.258220 IP (tos 0x0, ttl 64, id 54956, offset 0, flags [DF], proto TCP (6), length 86) server.workflowproducts.com.smtp > mx-ecom.netflix.com.16090: Flags [.], seq 1:47, ack 1, win 58240, length 46 E..V..@.@.....,..KL...>.=....._EP... =..220 server.workflowproducts.com ESMTP Postfix 19:31:32.343568 IP (tos 0x0, ttl 46, id 7127, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.16090 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 47, win 46, length 0 E..(..@...'..KL...,.>....._E=...P....o........ 19:31:32.343631 IP (tos 0x0, ttl 64, id 25513, offset 0, flags [DF], proto TCP (6), length 41) server.workflowproducts.com.smtp > mx-ecom.netflix.com.16090: Flags [P.], seq 47:48, ack 1, win 58240, length 1 E..)c.@.@.....,..KL...>.=....._EP... ... 19:31:32.429025 IP (tos 0x0, ttl 46, id 7128, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.16090 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 48, win 46, length 0 E..(..@...'..KL...,.>....._E=...P....n.....QK. 19:32:33.030239 IP (tos 0x0, ttl 46, id 7129, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.16090 > server.workflowproducts.com.smtp: Flags [F.], seq 1, ack 48, win 46, length 0 E..(..@...'..KL...,.>....._E=...P....m....W..} 19:32:33.030287 IP (tos 0x0, ttl 64, id 33126, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.16090: Flags [.], seq 48, ack 2, win 58240, length 0 E..(.f@.@.....,..KL...>.=....._FP... ... 19:32:33.031485 IP (tos 0x0, ttl 46, id 24806, offset 0, flags [DF], proto TCP (6), length 52) mx-ecom.netflix.com.48614 > server.workflowproducts.com.smtp: Flags [S], seq 1264180913, win 5840, options [mss 1380,nop,nop,sackOK,nop,wscale 7], length 0 E..4`.@......KL...,.....KY..........f......d........ 19:32:33.031517 IP (tos 0x0, ttl 64, id 19530, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.16090: Flags [F.], seq 48, ack 2, win 58240, length 0 E..(LJ@.@.....,..KL...>.=....._FP... ... 19:32:33.031525 IP (tos 0x0, ttl 64, id 50723, offset 0, flags [DF], proto TCP (6), length 52) server.workflowproducts.com.smtp > mx-ecom.netflix.com.48614: Flags [S.], seq 1154320061, ack 1264180914, win 65535, options [mss 1460,nop,wscale 6,sackOK,eol], length 0 E..4.#@.@.....,..KL.....D...KY...... ............... 19:32:33.119899 IP (tos 0x0, ttl 46, id 0, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.16090 > server.workflowproducts.com.smtp: Flags [.], seq 2, ack 49, win 46, length 0 E..(..@...B..KL...,.>....._F=...P....l.....).m 19:32:33.120249 IP (tos 0x0, ttl 46, id 24807, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.48614 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 1, win 46, length 0 E..(`.@......KL...,.....KY..D...P............. 19:32:33.120268 IP (tos 0x0, ttl 64, id 18491, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.48614: Flags [.], seq 1, ack 1, win 58240, length 0 E..(H;@.@.....,..KL.....D...KY..P... ... 19:32:33.125416 IP (tos 0x0, ttl 64, id 22818, offset 0, flags [DF], proto TCP (6), length 86) server.workflowproducts.com.smtp > mx-ecom.netflix.com.48614: Flags [.], seq 1:47, ack 1, win 58240, length 46 E..VY"@.@.....,..KL.....D...KY..P... =..220 server.workflowproducts.com ESMTP Postfix 19:32:33.216807 IP (tos 0x0, ttl 46, id 24808, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.48614 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 47, win 46, length 0 E..(`.@......KL...,.....KY..D...P..........I.i 19:32:33.216826 IP (tos 0x0, ttl 64, id 22138, offset 0, flags [DF], proto TCP (6), length 41) server.workflowproducts.com.smtp > mx-ecom.netflix.com.48614: Flags [P.], seq 47:48, ack 1, win 58240, length 1 E..)Vz@.@.....,..KL.....D...KY..P... ... 19:32:33.301847 IP (tos 0x0, ttl 46, id 24809, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.48614 > server.workflowproducts.com.smtp: Flags [.], seq 1, ack 48, win 46, length 0 E..(`.@......KL...,.....KY..D...P...........`. 19:34:34.030537 IP (tos 0x0, ttl 46, id 24810, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.48614 > server.workflowproducts.com.smtp: Flags [F.], seq 1, ack 48, win 46, length 0 E..(`.@......KL...,.....KY..D...P.........s.2. 19:34:34.030569 IP (tos 0x0, ttl 64, id 18365, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.48614: Flags [.], seq 48, ack 2, win 58240, length 0 E..(G.@.@.....,..KL.....D...KY..P... ... 19:34:34.031927 IP (tos 0x0, ttl 64, id 54930, offset 0, flags [DF], proto TCP (6), length 40) server.workflowproducts.com.smtp > mx-ecom.netflix.com.48614: Flags [F.], seq 48, ack 2, win 58240, length 0 E..(..@.@.....,..KL.....D...KY..P... ... 19:34:34.121788 IP (tos 0x0, ttl 46, id 0, offset 0, flags [DF], proto TCP (6), length 40) mx-ecom.netflix.com.48614 > server.workflowproducts.com.smtp: Flags [.], seq 2, ack 49, win 46, length 0 E..(..@...B..KL...,.....KY..D...P..........h.. Regards, Justin T