source ip if agent checks

[tvtue]

Hi,

I wonder what the source ip is, when you setup a agent item e.g. net.tcp.service[tcp,,995].

I tried to figure it out with tcpdump, but I cannot see any packets from 127.0.0.1 nor from the host ip where the agent is running on.

Any idea where I am going wrong?
TIA
Timo