'line monitor': solved

[Jeff Gordon <jeff.gordon@wellnow.com>]

This worked:

   tcpdump -a -i ppp0 -l -vvv -w dat.file

Later:

   snort -dv -r dat.file

(More info than I needed arrived in dat.file, but it did include the
specific info I was seeking.  I expect 'sniffit' would've worked, but
apparently it needs for a particular SysV switch to have been included 
in the compiling of the kernel.)

-- 

 -- Jeff --   <http://www.wellnow.com>

 "There's nothing left in the world to prove.  All that's worth doing
  is to love one another, using whatever means are available to serve."