Use tcpdumpon the command line or wiresharkon the desktop.
For example, to capture web traffic.
tcpdump -s0 -i any -wfile.pcap port 80
To view it directly, delete-wfile.pcap
To read a previously saved file
tcpdump -r file.pcap
-, HTTP, tcpflow -C port 80