Use tcpdump to find and isolate packets/sessions/events of interest. Use Wireshark to inspect details.