Right, I am trying to capture some traffic using: tcpdump -f -xx '( port 8000 ) and (( ! src net 10.0.0.0/8 ) or ( ! dst net 10.0.0.8 ))' Oops. that should read: tcpdump -f -xx '( port 8000 ) and (( ! src net 10.0.0.0/8 ) or ( ! dst net 10.0.0.0/8 ))'