The naming scheme for the output files is client_file (for communication received from the input_port) or server_file (for communication received from the output_port) followed by a period ('.') followed by the process id of the bug program followed by a period ('.') followed by the process id of the child of bug which actually does the monitoring. Thus, for every connection made to the input_port, there will be two (unique) files created.
The output files are probably best read by using od(1) with the "-c" or "-cx" options.
This invocation will create, for every connection to port 3000 on the current machine, two files (cl.pid.cpid and se.pid.cpid). Every communication to port 3000 is repeated verbatim to port 2999 on machine "moosebreath" and written to the first file. All responses are written to the second file.
Goodness knows what systems this will actually run on. Any BSD or BSD-derived system SHOULD work.
There should be an option to change the MARK.