• Check man pcap-filter for tcpdump expression syntax and fields
• Capture file

tcpdump -w capture.pcap -i any host google.com