How can I capture a TCP dump on Linux?

The following url shows how to use the command line tcpdump to do a packet trace. http://jcifs.samba.org/src/docs/capture.html

To capture an ldap communication, you need to make sure that webnetwork is not set to use SSL to talk to LDAP. You can also set the tcpdump to only capture port 389. You will also want to add -s 0 to make sure you get all of the information.

This will just capture data on port 389 : tcpdump -s 0 -w mycapture.pcap ’port 389’

This will capture data on multiple ports* : tcpdump -s 0 -w mycapture.pcap ’port 137 || 138 || 139 || 445’
*These ports are using when debuging cifs / smb / jcifs communication.