dump traffic on a network

-i     Listen on interface.  If unspecified, tcpdump searches the system interface list  for  the  lowest
       numbered,  configured up interface (excluding loopback).  Ties are broken by choosing the earliest
       match.

       On Linux systems with 2.2 or later kernels, an interface  argument  of  ``any''  can  be  used  to
       capture packets from all interfaces.  Note that captures on the ``any'' device will not be done in
       promiscuous mode.

       If the -D flag is supported, an interface number as printed by  that  flag  can  be  used  as  the
       interface argument.

-U     Make output saved via the -w option ``packet-buffered''; i.e., as each packet is saved, it will be
       written to the output file, rather than being written only when the output buffer fills.

       The -U flag will not be supported if tcpdump was built with an older version of libpcap that lacks
       the pcap_dump_flush() function.

-s     Snarf snaplen bytes of data from each packet rather than the  default  of  65535  bytes.   Packets
       truncated because of a limited snapshot are indicated in the output with ``[|proto]'', where proto
       is the name of the protocol level at which the truncation has occurred.  Note that  taking  larger
       snapshots  both  increases  the  amount  of  time  it  takes  to process packets and, effectively,
       decreases the amount of packet buffering.  This may cause packets to be lost.   You  should  limit
       snaplen  to  the  smallest number that will capture the protocol information you're interested in.
       Setting snaplen to 0 sets it to the default of 65535,  for  backwards  compatibility  with  recent
       older versions of tcpdump.

-w     Write the raw packets to file rather than parsing and  printing  them  out.   They  can  later  be
       printed with the -r option.  Standard output is used if file is ``-''.  See pcap-savefile(5) for a
       description of the file format.