• deteksi koneksi keluar via http

tcpdump -A -i eth0 -s 1500 port not 22

• tcpdump pengecualian port

port not 22

• Cek hanya di port 80

tcpdump -A -i eth0 -n -s 1500 dst port 80

• Analyse http post

tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'