Tcpdump

Tcpdump prints out the headers of packets on a network interface that match the boolean expression. It can also be run with the -w flag, which causes it to save the packet data to a file for later analysis, and/or with the -b flag, which causes it to read from a saved packet file rather than to read packets from a network interface. In all cases, only packets that match expression will be pro­cessed by tcpdump.

Tcpdump will, if not run with the -c flag, continue cap­turing packets until it is interrupted by a SIGINT signal (generated, for example, by typing your interrupt charac­ter, typically control-C) or a SIGTERM signal if run with the -c flag, it will capture packets until it is interrupted by a SIGINT or SIGTERM signal or the specified number of pack­ets have been processed.