Packet capture is one of the most fundamental and powerful ways to do network analysis.
tcpdump uses a “one-off-command” approach that lends itself to quick, on-the-spot answers. You can run it through an SSH session, doesn’t need X and is more likely to be there when you need it. And, because tcpdump uses standard command-line conventions (such as writing to STDOUT, which can be redirected), tcpdump can be used in all sorts of creative, interesting and extremely useful ways.
You can even use tcpdump and Wireshark together by capturing the network data with tcpdump for viewing with Wireshark. To ensure that you capture complete packets, use the following command:
tcpdump -i <interface> -s 65535 -w <some-file>
If you are embedded Linux system developer, remember that you can easily fit the tcpdump program inside a small embedded Linux system without too much problem (which is not the case with Wireshark, because it is a huge program that needs GUI and has many dependencies).