Tcpspy is an administrator's tool that logs information about incoming and outgoing TCP/IP connections. It's written in C and uses no libpcap functions, unlike tcpdump.

Connections are selected for logging with rules, similarly to the filter expressions accepted by tcpdump. The following information is logged: username, local address and port, remote address and port, and, optionally, the executable filename.

This Debian version supports IPv4 and IPv6.