tcpdump Dump on specific interface tcpdump -i <interface> Dump as a file for Wireshark tcpdump -i <interface> -s 65535 -w <file> To capture any traffic sent to or from a given MAC address, tcpdump ether host e2:a0:71:60:e5:2a