tcpdump host 210.27.48.1 and \ (210.27.48.2 or 210.27.48.3 \)
截获主机210.27.48.1 和主机210.27.48.2 或210.27.48.3的通信
http://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html
linux tcpdump命令抓包
原文：http://www.cnblogs.com/xihong2014/p/6122528.html
