1. Incoming and Outgoing TCP/IP connections logger. tcpspy is an administrator's tool that logs information about incoming and outgoing TCP/IP connections. It's written in C and uses no libpcap functions, unlike tcpdump. Connections are selected for logging with rules, similarly to the filter expressions accepted by tcpdump. The following information is logged: username, local address and port, remote address and port, and, optionally, the executable filename. At present, only the IPv4 protocol is supported. From Debian 3.0r0 APT