The command that will capture just about everything for tcpdump is: sudo tcpdump -lxxvventtteXSs 0 -w /disk1/TCPdebug/28.pcap