tcpdump

http://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html