Links

Wireshark

Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Originally named Ethereal, the project was renamed Wireshark in May 2006 due to trademark issues.
-- Wikipedia

Packet filtering

Operators:

Examples

IP address (any)
ip.addr == <ip-address>
Source and destination IP addresses
ip.src == <src-ip-address> and ip.dst == <dst-ip-address>
Protocol
<protocol>
http
Protocol contains string
<protocol> contains <string>
http contains google.com
TCP port
tcp.port eq <port>
UDP port
udp.port eq <port>
Negation
not <expression>

Capture packets

ssh <user>@<ip> "/usr/sbin/tcpdump -i ens33 -U -s0 -w - 'not port 22'" > bla.cap
wireshark bla.cap
Alternative approach
ssh <user>@<ip> "/usr/sbin/tcpdump -i lo -U -s0 -w - 'not port 22'" | wireshark -k -i -