Ben Hutchings on Twitter: "@b0rk According to the tcpdump man page this is "pcap filter syntax". BPF is the instruction set it's compiled to." / Twitter
Analyzing network traffic with tcpdump –part 1 | Tournas Dimitrios
Use tcpdump to capture in a pcap file (wireshark dump) | Linux Explore