Wireshark

Capturing packets gives you a heap of raw bytes; understanding them is another matter entirely. Wireshark is the most popular tool for turning that heap into something a human can read. Think of it as a translator and microscope for network conversations: it takes the captured bytes and decodes them layer by layer, showing you the Ethernet frame, the IP header inside it, the TCP segment inside that, and the HTTP request inside that — all expanded into plain, labelled fields you can click through.

In practice you either let Wireshark capture live from an interface or open a .pcap file made by tcpdump. Its top pane lists packets one per line; click one, and the middle pane shows that packet fully dissected into a tree of named fields (source port, sequence number, flags, and so on), while the bottom pane shows the raw bytes. It understands thousands of protocols, so it labels everything for you. Crucially it can also follow a TCP stream to reassemble a whole conversation, colour-code problems like retransmissions, and compute expert summaries — all of which let you go from "a packet" to "the story of this connection."

Two honest points. Wireshark is an analysis front-end, not a capture engine of its own: under the hood it uses the same libpcap/Npcap and BPF capture facility as tcpdump, so the same rules and limits apply — you see only what reaches your interface, and on a busy link you can drop packets. And it decodes, it does not decrypt: if traffic is protected by TLS, Wireshark shows you the encrypted TLS records, not the plaintext inside, unless you supply the session keys. It is a superb diagnostic and learning tool, but it cannot magic open traffic that was encrypted for a reason.