tcpdump

Packet capture.

$ sudo tcpdump -ni any port 443
$ sudo tcpdump -ni any -w out.pcap host 1.2.3.4
$ sudo tcpdump -r out.pcap
$ sudo tcpdump -A 'tcp port 80'