I think tcpdump is the better solution since it's less intrusive into your production environment. Even if the tool suddenly crashes, it will not interrupt the

I think tcpdump is the better solution since it's less intrusive into your production environment. Even if the tool suddenly crashes, it will not interrupt the flow of requests to your servers. Something similar, like using libnetfilter_queue, would also be good.