tcpdump

How to find right interface 

route get 
netstat -nr


To list all network interfaces
tcpdump -D
ifconfig -a | grep :

To capture traffic from interface eth0, source ip = 10.10.10.10 & destination ip = 10.10.10.11
tcpdump -i eth0 src 10.10.10.10 and dst 10.10.10.11

Reference:

Manpage of TCPDUMP

http://www.tcpdump.org/tcpdump_man.html

A tcpdump Tutorial and Primer
http://danielmiessler.com/study/tcpdump/

Check The Routes
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch35_:_Configuring_Linux_VPNs#Check_The_Routes

Using TCPdump

http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch35_:_Configuring_Linux_VPNs#Using_TCPdump

SANS POCKET REFERENCE GUIDE: TCP/IP and tcpdump
http://www.sans.org/security-resources/tcpip.pdf?ref=3871

Checkpoint: fw monitor

Let say we want to monitor the following informations:

Source IP = 10.10.10.10
Destination IP = 10.10.10.11

[Expert@cpmodule]# fw monitor -e 'accept src=10.10.10.10 or dst=10.10.10.11;'
monitor: getting filter (from command line)
monitor: compiling
monitorfilter:
Compiled OK.
monitor: loading
monitor: monitoring (control-C to stop)
^C
monitor: caught sig 2
monitor: unloading
[Expert@cpmodule]# cat $FWDIR/tmp/monitorfilter.pf
#define src ip_src
#define dst ip_dst
#define sport th_sport
#define dport th_dport
#include "tcpip.def"
accept src=10.10.10.10 or dst=10.10.10.11;

Reference:
How to use fw monitor (page 36)
http://www.checkpoint.com/techsupport/downloads/html/ethereal/fw_monitor_rev1_01.pdf

FW MONITOR
http://www.cpug.org/check_point_resources/FW MONITOR_expert.doc