222

Appendix A     Introduction to tcpdump

13:05:52.226049 eth0 > dti414.1245 > rr laptop.6001: . 2045:3493(1448) 

ack 32 win 63712  (DF)

13:05:52.226049 eth0 > dti414.1245 > rr laptop.6001: P 3493:4089(596) 

ack 32 win 63712  (DF)

13:05:52.226049 eth0 < rr laptop.6001 > dti414.1245: . 32:32(0) ack 

4089 win 64240  (DF)

You can use a number of command line switches with the command. A list of

switches is available on the manual pages. The important switch to use with Snort is

 r 

, where filename is the file containing Snort data. Simple Snort log

files can't be used with this option. Only the files that are created in the tcpdump for 

mat can be read by the command.