Use tcptump + ngrep as ngrep have problems with newer kernels (?)