> > Make sure you run it with '-s 1500' to get the full packets, and it
> > wouldn't hurt to run it with '-w /tmp/telnet.tcpdump' so you can play
> > back the data if you snag something interesting.
> >
> since 2 days i'm under attack again and have >2MB gzipped dumps but no
> telnetd.core for now...

got telnetd.core and full tcpdump of that time

now there's -g compiled telnetd on server - waiting for another core