Capture everything and inspect it later’ sounds reassuringly forensic until the PCAP consumes the disk, records half the office, and still buries the failed handshake beneath six million irrelevant packets. Here is how to make tcpdump answer one question at a time – with limits established before optimism becomes an incident.