document updated a month ago, on Apr 10, 2025

the basic starting place for a tcpdump command

sudo tcpdump --interface=any --snapshot-length=0 -n -w /var/tmp/$HOSTNAME.$(date +%4Y-%m-%d_%H-%M-%S).pid_$$.pcap;   ls -lrt /var/tmp/*.pcap | tail

An explanation of each flag:

-n Don't convert IP addresses⇒DNS names while capturing. This is optional, but I think Wireshark's built-in name resolution mechanisms work just fine.
--interface You can figure out the right interface to capture from first, but it's much less hassle to just capture from all of them.
-s 0 Without this, tcpdump records truncated packets. Why would that be the default behavior?!

alternatively:

PCAPFILE=/var/tmp/$HOSTNAME.$$.pcap;   rm -f "$PCAPFILE";   tcpdump --interface=any --snapshot-length=0 -n -w "$PCAPFILE"

And consider adding some filter onto the end: