more fun with tcpdump
prefer to use default vim key binding though it's a bit hard to play