Connection table entry removed after idle timer reaches tcp keep alive value

if you are running 11.2.0 or later, you may try this.

by the way, please make note the time when entry is removed from connection table. so, you can match it in the tcpdump file.

 tcpdump -nni 0.0:nnnp -s0 -w /var/tmp/output.pcap host x.x.x.x -v
x.x.x.x is client ip

sol13637: Capturing internal TMM information with tcpdump