Wireshark solves another problem, when you need it, you have a problem where you want to analyze the packet content, or drill and cut through a historical captu

Wireshark solves another problem, when you need it, you have a problem where you want to analyze the packet content, or drill and cut through a historical capture. That's not always what you need, and it's often cumbersome to run on a remote server that isn't supposed to have GUI stuff installed anyhow. Sometimes you just need to know if DNS resolution is working. Or if the right DNS server is queried. Or if some server backend is actually firing off packets to the proper place when you hit a button on the frontend. Or you just need to verify that data are coming in when the guy on the phone says "check again now". For these sort or problems, tcpdump is great, as it easily allows you to experiment with different filters on the command line, which will take you an order of magnitude more time click through in wireshark or wait for reparsing if you use a display filter.