Some simple usage:
all packets arriving at or departing from 192.168.0.2 # tcpdump -n host 192.168.0.2
To print traffic between 192.168.0.2 and either 10.0.0.4 or 10.0.0.5: # tcpdump -n host 192.168.0.2 and \( 10.0.0.4 or 10.0.0.5 \)
To print all IP packets between 192.168.0.2 and any host except 10.0.0.5: # tcpdump ip -n host 192.168.0.2 and not 10.0.0.5
To print all traffic between local hosts and hosts at Berkeley: # tcpdump net ucb-ether
To print all ftp traffic through internet gateway xx: # tcpdump 'gateway xx and (port ftp or ftp-data)'
To print traffic neither sourced from nor destined for local hosts (if you gateway to one other net, this stuff should never make it onto your local net). # tcpdump ip and not net localnet
To print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host. # tcpdump 'tcp[13] & 3 != 0 and not src and dst net localnet'
To print IP packets longer than 576 bytes sent through gateway xx: # tcpdump 'gateway xx and ip[2:2] > 576'
To print IP broadcast or multicast packets that were not sent via ethernet broadcast or multicast: # tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
To print all ICMP packets that are not echo requests/replies (i.e., not ping packets): # tcpdump 'icmp[0] != 8 and icmp[0] != 0“
Unsorted links
You found something interesing on the net and you don't know where to put it?? This is the place!
Install qpdf
aptitude install qpdf
Decrypt your pdf
qpdf --password=password --decrypt input.pdf output.pdf