adam.nz aboutpostsprojectscontact
# ngrep -qpi '(^user )|( login )' '(host 192.168.1.1 and ((port 143) or (port 110)))'
Watch for traffic to 192.168.1.1 on ports 110 or 143 which start with “user” or contain “login”.