tcpdump and wireshark, and tshark: Length specification turned out to be kind of a pain in pcap-filter syntax Because TCP doesn't directly include a length field tshark turned out easier, so here's my suggestion: tshark -Y 'tcp.port == 5190 && tcp.len > 0' -P -Q -x I put all of you in the wireshark group so you can run that Please be nice to other users Anything going out unencrypted is expected to be visible anyway Alright, race conditions! Sending to a client Deleting clients from the vector Test with a bunch of people Where could these occur on a server? 100 bots all go in a room and call fight... Next topic: DNS