To record packets coming in and going out to any host on every interface, enter:
The trace information is placed in the /tmp/nettrace file.
To record packets received on an interface en0 from a remote host airmail over the Telnet port, enter:
iptrace -i en0 -p telnet -s airmail /tmp/telnet.trace
The trace information is placed in the /tmp/telnet.trace file.