I’m always forgetting which options get me the output I like from tcpdump so I’m posting it here for all to see. This line gets close to the output of EetherPeek that I always liked but costs about $500 less. Here it is:

tcpdump -vvv -i en0 -X -s 0

Here’s a breakdown for what it does:

• “-vvv” Turns on uber-verbose mode giving the most information
• “-i en0″ sets the device to listen on (in this case the first ethernet card)
• “-X” prints hex and any ascii text (human readable)
• “-s 0″ grabs the entire packet (or n bytes if not 0)