If you are looking to capture full TCP handshake, make sure you use 'host' vs 'src host' or 'dst host' to see both request and response flow. When capturing packets over a long period of time, you can enable file rotation. The capture file can also be inspected with other packet analyzer tools such as Wireshark. Note 2: When you specify a source (src) or destination (dst) flags, tcpdump will only filter in that direction. 15:47:24.248737 - The timestamp of the captured packet is in local time and uses the following format: hours:minutes:ac. Separate your entries with a comma, space, or semicolon. This utility is not encompassing of all options tcpdump offers a complete list of options can be found via its manual: Note: Host, Source Host, and Destination Host can take multiple entries. This utility is to help generate a tcpdump command using some of the more common switches / filters offered by the tcpdump. tcpdump is very versatile with many switches to granularly capture what you need to dubug network traffic with options to output results via console, file, or wireshark pcap. In short, it's the wireshark of linux to gathering packet captures.

Tcpdump is a utility commonly installed / available to many Linux distributions to quickly gather a network trace / packet capture.

Tcpdump wireshark pcap format