tcpdump -s 0 -X host 172.16.100.111 and port 80 -w 1.dump
tcpdump -X -s 0 host 172.16.100.64 and 172.16.100.161 and port 110 -w pop.cap
tcpdump -i eth0 host 172.16.103.25 and dst port 80
tcpdump使用方法
原文：http://www.cnblogs.com/topicjie/p/7188313.html
