Refactor and add mathcheck

Nit: could be rewritten as string.format('tcpdump -d "len < %s"', str_expr) and saves variable expr.