Five invocations cover most of what I ever need on a box that is misbehaving. Everything else is a variation on these.
1. Watch DNS only
tcpdump -i any -n port 53-n matters: without it tcpdump resolves addresses, which generates the very DNS traffic you are trying to observe.
2. Catch the TLS handshake
tcpdump -i any -n 'tcp port 443 and (tcp[((tcp[12:1] & 0xf0) >> 2)] = 0x16)'That byte offset selects the TLS record type for handshake, so you see client hellos without drowning in application data.
3. Find the slow API call
tcpdump -i any -n -ttt host api.internal and port 8080-ttt prints the delta between packets. The gap in the middle of the trace is your latency, and it will usually be sitting right before the server’s first response byte.
4. Write a capture for later
tcpdump -i any -n -s 0 -w /tmp/trace.pcap host 10.0.0.75. Ring buffer for intermittent faults
tcpdump -i any -n -w /tmp/ring.pcap -C 100 -W 10Ten files, one hundred megabytes each, rotating. Leave it running until the fault reproduces, then hand the newest file to Wireshark.