#!/bin/bash

tcpdump -i eth0 port 110 or port 143 -w imap_pop3.pcap