TCPDump

        This is a program to capture packets that are transferred across a network. Unlike wireshark, TCPDump is all command line. I personally don't feel that it allows for analytics the way that Wireshark does just because it is all in the terminal. To use it, we need to set a specified interface to use that we wish to capture the packets from. The follow command is a good example: "tcpdump -n -i eth0 -s 1515 -w [filename].lpc".
The -n flag disables the translation of IP addresses to host names and port numbers to services. This is good if we are looking for a specific ip address. The -i flag is of course the interface to use. The -s designates the size of the packets it should capture. In this example we are capturing 1515 bytes. Finally, the -w flag is where to write the output file.

Personal Remarks: When faced with an option, I will chose Wireshark over TCPDump every time. Sadly, not every situation allows for wireshark to be used. Wireshark is a full blown program that can leave a large footprint on a victim machine. TCPDump on the other hand is ran right from the command line. It is a bit difficult to parse all the data easily though, which can be a pain. I'm sure it'd be a lot easier if I used the program daily, but I don't.