Wireshark

tshark -f “host 1.1.1.1 and tcp port 10101” -i any -w nhlDEV.01032019.pcap -F libpcap