The amazing part behind the pcapng format is that it's a streamlined format for multiple network interface streams. And, tcpdump and most snort using tools hav

The amazing part behind the pcapng format is that it's a streamlined format for multiple network interface streams. And, tcpdump and most snort using tools have support for it too. You can literally build a local IDS/IPS by using command line tools these days. As a former network security engineer, wireshark helped me really _understand_ problems in network protocols, in addition to reading other implementations and the RFCs. It taught me about wrong assumptions in the protocols, naive implementations and their exploitable bugs, and so on. It's amazing as a tool to make unit tests with exported buffers for your parsers, too :) Wireshark and tcpdump are really underappreciated tools in the network space, and I can highly recommend getting familiar with them. Having the possibility to have a remote pcap stream from a buggy server inside your local wireshark GUI is just way much more efficient for debugging. Debugging time is reduced from days to minutes, quite literally. I use tcpdump in my CI/CD build environments, too, which makes debugging a failed network test a blaze. I can just open the pcap file with wireshark or do a local replay of the same packages to test the code, which is amazing.