Monitoramento de pacotes

sudo tcpdump -w test.pcap -i eth1 tcp port 6881 or udp \( 33210 or 33220 \)

fonte: http://linux.byexamples.com/archives/283/simple-usage-of-tcpdump/