tcpdump
NetworkPackage: tcpdump
Captures the packets crossing an interface and prints them, filtered by host, port or protocol. The final arbiter: when two machines disagree about what was sent, tcpdump shows what actually went over the wire.
What its options do in the lessons
From the same glossary the lessons render under their commands, so the two cannot disagree.
tcpdump -i- Which interface to listen on.
-i anylistens on all of them — the right choice when you do not yet know which one the packet arrives on; that pseudo-interface does not use promiscuous mode. tcpdump -n- Prints addresses and port numbers as they are, with no reverse lookups: the capture cannot stall on a DNS server, and you read what the client actually aimed at.
tcpdump -c- Exits after that many packets instead of running until Ctrl+C: a capture you walk away from ends on its own.
tcpdump -w- Writes the raw packets to a file instead of printing them. Nothing appears while it runs, and the file is read back with
-r— this is what a ticket to the provider attaches. tcpdump -r- Reads a saved capture file instead of listening on an interface. It is the one tcpdump invocation that needs no special privileges.