Could you elaborate on why using tcpdump is a better idea?