안녕하세요.
 미리미리 공부을 해야 한다는걸 절실히 느끼고 있습니다. ㅡ.ㅡ;
tcpdump의 결과는 다음과 같습니다.
 22:00:39.632207 196.37.75.158.1024 > 172.16.113.105.finger: S 3890051842:3890051842(0) win 512 <mss 1460>
22:00:39.632560 172.16.113.105.finger > 196.37.75.158.1024: S 3707117089:3707117089(0) ack 3890051843 win 32736 <mss 146
0> 22:00:39.635343 196.37.75.158.1024 > 172.16.113.105.finger: . ack 1 win 32120 (DF)
22:00:39.635534 196.37.75.158.1024 > 172.16.113.105.finger: P 1:5(4) ack 1 win 32120 (DF)
22:00:39.646990 172.16.113.105.finger > 196.37.75.158.1024: . ack 5 win 32732 (DF)
22:00:39.647691 196.37.75.158.1024 > 172.16.113.105.finger: P 5:7(2) ack 1 win 32120 (DF)
22:00:39.666927 172.16.113.105.finger > 196.37.75.158.1024: . ack 7 win 32730 (DF)
22:00:40.150653 172.16.113.105.finger > 196.37.75.158.1024: P 1:276(275) ack 7 win 32736 (DF)
22:00:40.150706 172.16.113.105.finger > 196.37.75.158.1024: F 276:276(0) ack 7 win 32736
22:00:40.151573 196.37.75.158.1024 > 172.16.113.105.finger: . ack 277 win 31844 (DF)
22:00:40.156140 196.37.75.158.1024 > 172.16.113.105.finger: F 7:7(0) ack 277 win 32120
22:00:40.156287 172.16.113.105.finger > 196.37.75.158.1024: . ack 8 win 32735 (DF)
22:00:40.699963 172.16.114.207.1024 > 195.73.151.50.smtp: S 4180099195:4180099195(0) win 512 <mss 1460>
22:00:40.704702 195.73.151.50.smtp > 172.16.114.207.1024: S 982117809:982117809(0) ack 4180099196 win 32736 <mss 1460>
22:00:40.704894 172.16.114.207.1024 > 195.73.151.50.smtp: . ack 1 win 32120 (DF)
 위의 것을 제가 필요한 필드만 잘라네고 싶습니다. 디비에 넣기 위해서
이죠. ㅡ.ㅡ;
 시간 소스아이피 소스포트 목적지아이피 목적지포트 플래그 나머지
 그런데 저는 지금 이렇게 밖에 못하고 있습니다. 다음과 같은 명령어로
말이죠. 완죤 초보. ㅡ.ㅡ;
 [hurryon@star ~/kokili]$ awk -F '{print $1, $2, $4, $5, $6, $7}' < tmp
22:00:39.632207 196.37.75.158.1024 172.16.113.105.finger: S 3890051842:3890051842(0) win
22:00:39.632560 172.16.113.105.finger 196.37.75.158.1024: S 3707117089:3707117089(0) ack
22:00:39.635343 196.37.75.158.1024 172.16.113.105.finger: . ack 1
22:00:39.635534 196.37.75.158.1024 172.16.113.105.finger: P 1:5(4) ack
22:00:39.646990 172.16.113.105.finger 196.37.75.158.1024: . ack 5
22:00:39.647691 196.37.75.158.1024 172.16.113.105.finger: P 5:7(2) ack
22:00:39.666927 172.16.113.105.finger 196.37.75.158.1024: . ack 7
22:00:40.150653 172.16.113.105.finger 196.37.75.158.1024: P 1:276(275) ack
22:00:40.150706 172.16.113.105.finger 196.37.75.158.1024: F 276:276(0) ack
22:00:40.151573 196.37.75.158.1024 172.16.113.105.finger: . ack 277
22:00:40.156140 196.37.75.158.1024 172.16.113.105.finger: F 7:7(0) ack
22:00:40.156287 172.16.113.105.finger 196.37.75.158.1024: . ack 8
22:00:40.699963 172.16.114.207.1024 195.73.151.50.smtp: S 4180099195:4180099195(0) win
22:00:40.704702 195.73.151.50.smtp 172.16.114.207.1024: S 982117809:982117809(0) ack
22:00:40.704894 172.16.114.207.1024 195.73.151.50.smtp: . ack 1
[hurryon@star ~/kokili]$
 두번째와 세번째 필드에서 아이피부분과 포트부분을 분리해야 겠는데 쉽지가
않네요. 혹시 패턴검사에 대해서 고수이신분이 있다면 도움을 부탁합니다.
 :)