A very cool piece that closely follows my line of thinking:
http://www.markshuttleworth.com/archives/28
View commentsComments
>> twitter.com/danielmiessler
tcpdump
lsof
find
xargs