tcpdump port http or port ftp or port smtp or port imap or port pop3 or port 5900 or port 5800 or port 5901 or port 8080 or port 8081 or port 22 or port 443 -l -A -i eth0 -w traf | egrep -A2 -B2 -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user |admin' &