If you need to track down the host that's swamping the network, all you need is headers. If you are trying to debug a web or database application, you probably need to see the contents of the packets as well as the headers.

The -X flag will include the packet data in the output.

The host keyword can be combined with port information to limit the report to data to and from a given host.

The two tests are connected with and to perform the Boolean and operation, and they report only those packets that are to or from noucorp.com and/or the HTTP server. The sample output shows the start of a GET request and the server's reply:

$ tcpdump -X -r /tmp/tcpdump.raw host noucorp.com and port http
reading from file /tmp/tcpdump.raw, link-type EN10MB (Ethernet)
11:12:04.708905 IP 192.168.1.44.35652 > noucorp.com.http: Flags [P.], seq 2939551893:2939552200, ack 1031497919, win 501, options [nop,nop,TS val 2063464654 ecr 28236429], length 307
 0x0000:  4500 0167 1e54 4000 4006 70a5 c0a8 012c  E..g.T@.@.p....,
 0x0010:  98a0 5023 8b44 0050 af36 0095 3d7b 68bf  ..P#.D.P.6..={h.
 0x0020:  8018 01f5 abf1 0000 0101 080a 7afd f8ce  ............z...
 0x0030:  01ae da8d 4745 5420 2f20 4854 5450 2f31  ....GET./.HTTP/1
 0x0040:  2e31 0d0a 486f 7374 3a20 6e6f 7563 6f72  .1..Host:.noucor
 0x0050:  702e 636f 6d0d 0a55 7365 722d 4167 656e  p.com..User-Agen
 0x0060:  743a 204d 6f7a 696c 6c61 2f35 2e30 2028  t:.Mozilla/5.0.(
 0x0070:  5831 313b 204c 696e 7578 2078 3836 5f36  X11;.Linux.x86_6
 0x0080:  343b 2072 763a 3435 2e30 2920 4765 636b  4;.rv:45.0).Geck
 0x0090:  6f2f 3230 3130 3031 3031 2046 6972 6566  o/20100101.Firef
 0x00a0:  6f78 2f34 352e 300d 0a41 6363 6570 743a  ox/45.0..Accept:
...
11:12:04.731343 IP noucorp.com.http > 192.168.1.44.35652: Flags [.], seq 1:1449, ack 307, win 79, options [nop,nop,TS val 28241838 ecr 2063464654], length 1448
 0x0000:  4500 05dc 0491 4000 4006 85f3 98a0 5023  E.....@.@.....P#
 0x0010:  c0a8 012c 0050 8b44 3d7b 68bf af36 01c8  ...,.P.D={h..6..
 0x0020:  8010 004f a7b4 0000 0101 080a 01ae efae  ...O............
 0x0030:  7afd f8ce 4854 5450 2f31 2e31 2032 3030  z...HTTP/1.1.200
 0x0040:  2044 6174 6120 666f 6c6c 6f77 730d 0a44  .Data.follows..D
 0x0050:  6174 653a 2054 6875 2c20 3039 2046 6562  ate:.Thu,.09.Feb
 0x0060:  2032 3031 3720 3136 3a31 323a 3034 2047  .2017.16:12:04.G
 0x0070:  4d54 0d0a 5365 7276 6572 3a20 5463 6c2d  MT..Server:.Tcl-
 0x0080:  5765 6273 6572 7665 722f 332e 352e 3220  Webserver/3.5.2.