This is a tcpdump on the host (UCS5,s2) while I did a showmount from the client (192.169.10.50) onto it.
===============
20:17:37.099912 IP s2.botree.eu.ssh > 192.168.10.50.36468: Flags [P.], seq 2797746309:2797746497, ack 1003952726, win 501, options [nop,nop,TS val 3564488795 ecr 1860229806]...