Make tcpdump, wall and useradd match formatting.

While writing a parser I found that some files does not conform to the formatting rules. Changed the ones I found.
I think they used triple-backtick because the command itself has backticks around the `date`.

But that brings up a good point that this example might be too specific - and not necessarily about the `tcpdump` command anymore. Maybe just `tcpdump -w dumpfile.pcap not port 22`?