# Monitoring TCP Packets

This section illustrates how to monitor TCP packets received by the system. This is useful in analyzing network traffic generated by applications running on the system.

## tcpdumplike.stp

While tcpdumplike is running, it will print out the following information about any received TCP packets in real time:

- Source and destination IP address (`saddr`, `daddr`, respectively)

- Source and destination ports (`sport`, `dport`, respectively)

- Packet flags

To determine the flags used by the packet, tcpdumplike uses the following functions:

- `urg` - urgent

- `ack` - acknowledgement

- `psh` - push

- `rst` - reset

- `syn` - synchronize

- `fin` - finished

The aforementioned functions return `1` or `0` to specify whether the packet uses the corresponding flag.

## tcpdumplike Sample Output

    -----------------------------------------------------------------
           Source IP         Dest IP  SPort  DPort  U  A  P  R  S  F
    -----------------------------------------------------------------
      209.85.229.147       10.0.2.15     80  20373  0  1  1  0  0  0
      92.122.126.240       10.0.2.15     80  53214  0  1  0  0  1  0
      92.122.126.240       10.0.2.15     80  53214  0  1  0  0  0  0
      209.85.229.118       10.0.2.15     80  63433  0  1  0  0  1  0
      209.85.229.118       10.0.2.15     80  63433  0  1  0  0  0  0
      209.85.229.147       10.0.2.15     80  21141  0  1  1  0  0  0
      209.85.229.147       10.0.2.15     80  21141  0  1  1  0  0  0
      209.85.229.147       10.0.2.15     80  21141  0  1  1  0  0  0
      209.85.229.147       10.0.2.15     80  21141  0  1  1  0  0  0
      209.85.229.147       10.0.2.15     80  21141  0  1  1  0  0  0
      209.85.229.118       10.0.2.15     80  63433  0  1  1  0  0  0
    [...]