[Blind-sysadmins] analyzing tcpdump traffic