Filter by port

Capture HTTPS traffic only

tcpdump -i eth0 port 443 -n

More tcpdump commands

Capture DNS queries

tcpdump -i any -n port 53

Monitor all DNS lookups on any interface
Show HTTP GET requests

tcpdump -i any -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'GET /'

Capture and print HTTP GET request lines
Capture between two hosts

tcpdump -i eth0 'host 10.0.0.1 and host 10.0.0.2'

BPF filter: traffic between exactly two endpoints
Verbose with packet content

tcpdump -i eth0 -vvv -A -s 0 port 5432

Full verbose output with ASCII packet content for PostgreSQL
Limit capture count

tcpdump -i eth0 -c 100 -w capture.pcap

Stop after capturing 100 packets