Daniel Miessler has posted a nice little introduction to tcpdump. If you’ve never used tcpdump go spend 15 minutes reading his post and trying some of the examples.