tcpdump host 210.27.48.1 and \ (210.27.48.2 or 210.27.48.3 \)

截获主机210.27.48.1 和主机210.27.48.2 或210.27.48.3的通信

http://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html

linux tcpdump命令抓包