tcpdump [opt] [not] proto dir type
opt: -nn\-vvv\-XX\-i\-c\-e
proto: tcp/udp/arp/ip/ether/icmp
dir: src、dst、src and dst、src or dst
type: host/port/net/portrange
exp:
tcpdump -i any -nn dst port 80 and src host 192.168.1.1 -s 2048 -XX -tt -w ret.cap