tcpdump
reading the wire itselftcpdump attaches to an interface and prints every packet that matches a filter — timestamp, addresses, ports and the protocol's own fields. When two machines disagree about what was sent, the capture is the only account neither of them wrote.
Logs record what a program believed happened. A capture records what was actually on the wire.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
The client, from ephemeral port 51844, asks to open a connection to port 443 and announces its initial sequence number.
The dot is the ACK bit. The server acknowledges the client's sequence number plus one and offers its own. About 12 ms after the SYN — that gap is the round-trip time.
A bare ACK from the client. tcpdump now prints relative numbers, so "ack 1" means one past the server's initial sequence.
Without a count it runs until interrupted. "length 0" on all three confirms no application data has moved yet — that begins with the next packet.
Switches
A switch changes how the command behaves. These are the ones used day to day; man tcpdump lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-i IFACE- Capture on this interface. "any" captures on all of them.
-n- Numeric: do not turn addresses into names. -nn leaves ports as numbers too.
-c NUM- Stop after capturing NUM packets.
-w FILE- Write the raw packets to a file, to open later in Wireshark.
-r FILE- Read packets back from a saved capture file.
-v- Verbose: decode more of each packet. -vv and -vvv go further.
-e- Show the link-layer header: source and destination MAC addresses.
-A- Print each packet’s payload as text.
-X- Print each packet’s payload in hex and text side by side.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
tcpdump -ni any port 53DNS on every interface — the quickest way to see which names a host is asking for.
tcpdump -ni eth0 -w capture.pcap host 192.0.2.10Writes full packets for one peer to a file, to open in Wireshark later.
tcpdump -ni eth0 'tcp[tcpflags] & (tcp-syn|tcp-rst) != 0'Only SYN and RST packets: every connection attempt and every refusal.
tcpdump -ni eth0 -e arpARP requests and replies with the Ethernet headers shown — who is claiming which address.
In cybersecurity
A capture shows everything that is not encrypted, to whoever is able to run one. It is the defender's best evidence and the reason plaintext protocols are a liability.
Telnet, FTP and plain HTTP put credentials on the wire as text. One capture with -A is all it takes to prove it.
A pcap holds whatever crossed the link — session cookies, internal names, sometimes passwords. Store and share it accordingly.
CAP_NET_RAW is close to full visibility of the host's traffic. Grant it deliberately, not by adding users to a group.
Encrypted traffic shows addresses, ports, timing and the server name in the handshake — not the content.
A burst of SYNs to many ports from one source, answered by RSTs, is a port scan as it looks on the wire.
A host sees only its own traffic on a switched network. Seeing more needs a mirror port or a tap.