Updates: pass numpackets to display, device to bind to (ie: eth0), and the program to be compiled - bpf stuff - eg: host www.google.ca, src 192.168.1.1, uses pcap_compile to generate the bpf info required to apply filtering so you don't have any and all packets coming in --- refer to man page for tcpdump for examples of filtering