Added tcpdump lexer

Some indentation fixes

syntax_files/markdown.yaml

@@ -1,3 +1,4 @@
+---
 filetype: markdown
 
 detect:

syntax_files/server-log.yaml

@@ -1,3 +1,4 @@
+---
 filetype: serverlog
 
 detect:
@@ -12,4 +13,3 @@ rules:
     - comment: "(referer\\: .*)"
     - statement: "[[:space:]]([0-9~:.]{2,}[-+:.0-9a-z~]+)[[:space:]]"
     - type: "(Mozilla|Chrome|Safari|Firefox|AppleWebKit|Linux x86_64|Gecko|Windows|Mac)"
-

syntax_files/sh.yaml

@@ -12,7 +12,7 @@ rules:
       # Shell commands
     - type: "\\b(cd|echo|export|let|set|umask|unset)\\b"
       # Common linux commands
-    - type: "\\b((g|ig)?awk|bash|dash|find|\\w{0,4}grep|kill|killall|\\w{0,4}less|make|pkill|sed|sh|tar|ping|traceroute|service|apt|apt-get|aptitude|yum)\\b"
+    - type: "\\b((g|ig)?awk|bash|dash|find|\\w{0,4}grep|kill|killall|\\w{0,4}less|make|pkill|sed|sh|tar|ping|traceroute|service|dpkg|apt|apt-get|apt-cache|aptitude|dpkg-buildpackage|yum)\\b"
       # Coreutils commands
     - type: "\\b(which|sudo|base64|basename|cat|chcon|chgrp|chmod|chown|chroot|cksum|comm|cp|csplit|cut|date|(l)?dd|df|dir|dircolors|dirname|du|env|expand|expr|factor|false|fmt|fold|head|hostid|id|install|join|link|ln|logname|ls|md5sum|mkdir|mkfifo|mknod|mktemp|mv|nice|nl|nohup|nproc|numfmt|od|paste|pathchk|pinky|pr|printenv|printf|ptx|pwd|readlink|realpath|rm|rmdir|runcon|seq|(sha1|sha224|sha256|sha384|sha512)sum|shred|shuf|sleep|sort|split|stat|stdbuf|stty|sum|sync|tac|tail|tee|test|time|timeout|touch|tr|true|truncate|tsort|tty|uname|unexpand|uniq|unlink|users|vdir|wc|who|whoami|yes)\\b"
     - identifier.var: "(^([[:space:]]+)?[A-Za-z0-9_]+)"

syntax_files/tcpdump.yaml

@@ -0,0 +1,16 @@
+---
+filetype: tcpdump
+
+detect:
+    filename: "\\.tcpdump$"
+
+rules:
+    - yellow: "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.([0-9]+|[a-z]+)"
+    - constant.number: "(\\[[^]]+\\])"
+    - preproc: "([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})"
+    - cyan: "^(\\d+):(\\d+):(\\d+)"
+    - red: "(\\s+\\d+)/(\\w+).*"
+    - magenta: "options\\s\\[.*\\].*"
+    - magenta: "\\s+([a-zA-Z-]+)$"
+    - comment: "\\s(seq|ack|win|IP)\\s"
+    - yellow: "\\s+([a-z-]+\\.)?[a-z-]+\\.[a-z-]+\\.[a-z-]+"