Sometimes you want to see the HTTP session between browser and HTTP server. You may use firebug for firefox, but in this case you are limited to see firefox session... For example you want to capture all packets at localhost on port 8004. You'd use 'tcpdump -i lo -A -s 0 "port 8004"'
- `-i lo` means to capture packets on the lo interface
- `-A` means to show the contents of the packets in ASCII
- `-s 0` means to show the whole packet - not to divide into the parts
- `port 8004` is a pcap expression
That's all for today about tcpdump and wireshark. I know that's not enough information about that stuff, but anything else you can find in man tcpdump and man wireshark. They are quite big to discuss in the blogline, just dive into their docs to figure out your options.

