Reading what actually crossed the wire. Articles tagged Packet Analysis cover capture points, filters, and decoding protocol exchanges frame by frame.
Craft spoofed ARP and IP packets with Scapy against a Cisco IOS-XE lab, then watch Dynamic ARP Inspection drop every forgery and name the attacker's real MAC.
Interface selection, BPF filters, reading the output line, writing and re-filtering pcap files, and safe long captures - all from a live run of tcpdump 4.99.5 against IOS-XE routers. Includes the privilege drop that kills rotating captures, and a telnet password readable on the wire.