Sometimes (most times?) you want to do the analysis in real-time in which case it helps to be fluent in tcpdump. Also, whether you're looking at the wireshark

Sometimes (most times?) you want to do the analysis in real-time in which case it helps to be fluent in tcpdump. Also, whether you're looking at the wireshark gui or tcpdump in a terminal, you're essentially looking at text. So a high res (retina) display is going to be nice to have in either case.