How do you use tcpdump to capture traffic on a busy production host without impacting performance or capturing more than you need?

On a loaded production host, an unfiltered tcpdump -i any is expensive: it copies every packet through the kernel packet filter and formats output in real time, which can add CPU and I/O pressure exactly when you can least afford it. Narrow the capture as much as possible before you start: bind to the specific interface (-i eth0), apply a BPF filter for the host/port/protocol you care about (host 10.0.1.5 and port 443), and cap the packet snap length with -s 96 (or -s 0 only when you truly need full payloads) so you are not copying full jumbo frames for a header-level investigation.

Always write to a file with -w capture.pcap rather than letting tcpdump format and print packets live — text formatting is far more expensive than writing raw packets to disk, and a pcap file lets you re-filter and analyze offline with Wireshark or tshark without re-capturing. Use -C and -W to rotate capture files so a long-running capture cannot fill the disk, and set a packet count limit (-c 100000) or a time-bounded window when you are debugging a specific incident rather than leaving a capture running indefinitely. If you only need connection setup/teardown behavior, filter on TCP flags instead of capturing full streams.