tcpdump
A command-line packet capture tool. When the network is doing something you can't explain, tcpdump shows you what's actually on the wire.
#What it is
tcpdump captures packets on a network interface and prints a one-line summary of each. It uses BPF filters to show only what you care about, so you're not drowning in traffic. Wireshark is the graphical equivalent, and can open files tcpdump saves.
#Why I use it
To prove something before betting the network on it. Before switching the router's DHCP off and letting Pi-hole hand out addresses, you need to know DHCP broadcasts from Wi-Fi devices actually reach the wired Pi. tcpdump answers that in ten seconds:
sudo apt install -y tcpdump
sudo tcpdump -ni eth0 'port 67 or port 68'Reconnect a phone to Wi-Fi. If a DHCP Discover appears, the broadcasts arrive. If nothing appears, don't cut over. I learned that one the hard way.
#Handy forms
sudo tcpdump -ni eth0 port 53 # watch DNS queries live
sudo tcpdump -ni eth0 host 192.168.1.66 # everything to or from one device
sudo tcpdump -ni eth0 -w capture.pcap # save for Wireshark-n skips name lookups (faster, and it doesn't create DNS traffic of its own); -i picks the interface.