Quote Originally Posted by U George
/usr/sbin/tcpdump -nn -i eth1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes

does print out port 25 connections:
2
:43:04.204926 PPPoE [ses 0xea20] LCP, Echo-Request (0x09), id 11, Magic-Num 0x90013b4f, length 12
12:43:04.205640 PPPoE [ses 0xea20] LCP, Echo-Reply (0x0a), id 11, Magic-Num 0x6b50a930, length 12
12:43:06.584410 PPPoE [ses 0xea20] [length 50 (4 extra bytes)] IP 91.124.204.37.2122 > 71.247.232.63.25: S 909181318:909181318(0) win 65535 <mss 1452,nop,nop,sackOK>
12:43:09.547613 PPPoE [ses 0xea20] [length 50 (4 extra bytes)] IP 91.124.204.37.2122 > 71.247.232.63.25: S 909181318:909181318(0) win 65535 <mss 1452,nop,nop,sackOK>
12:43:12.683181 PPPoE [ses 0xea20] LCP, Echo-Request (0x09), id 165, Magic-Num 0x6b50a930, length 8

I dont understand whats wrong
Err.. That's not port 25 traffic. You're looking at PPPoE traffic.
http://en.wikipedia.org/wiki/Point-t..._over_Ethernet

You need to capture the traffic on the PPPoE interface.