Yeah, that's what I mean about them being complimentary, tcpdump being useful to create the initial capture on a remote host, and Wireshark being useful to sift

Yeah, that's what I mean about them being complimentary, tcpdump being useful to create the initial capture on a remote host, and Wireshark being useful to sift through it.