tcpdump is just a way of capturing the traffic, it's not a great analysis tool. It's simple, command-line, and part of the base install for many distributions.

tcpdump is just a way of capturing the traffic, it's not a great analysis tool. It's simple, command-line, and part of the base install for many distributions. Generally very useful when you're remote debugging where you don't have a GUI: the workflow is tcpdump -> download .pcap to local machine -> analyze offline with wireshark. Alternately, tcpdump -> analyze in situ with tshark. (You can also use tshark directly, but then you don't get a do-over if you want to change your display filters and such). Also, easily scriptable.