Spent a lot of time researching Tcpdump options and syntaxes. I use it all the time, but it's such a beast of a tool. 

--> n33dle