NOTE
tcpdump
Packet capture with BPF filters for debugging TCP, DNS, routing, retransmissions, and network failures.
This is a historical learning note and may contain outdated or incomplete understanding.
tcpdump captures packets from network interfaces and applies BPF-style filters by host, port, protocol, flags, and other fields. It is valuable for verifying whether packets were sent/received and for analyzing handshakes, retransmissions, resets, DNS, and routing behavior.
Encrypted application payloads remain encrypted in packet captures unless keys/decryption support are available. Keep captures bounded, filter aggressively, and protect packet data because it can contain sensitive metadata or plaintext protocols.