# tcpdump -s 0 -i eth0 dst port 80 -w /tmp/tcpdump.cap
# tcpdump -s 0 host 192.168.1.1 port 80 -w /tmp/tcpdump.cap
# tcpdump -n -tttt -r tcpdump.cap