Postmortem inspection of tcpdump