How do -i lo and host 127.0.0.1 differ in a tcpdump command?
-i lo
host 127.0.0.1
tcpdump
Both options select the same capture interface.
The first limits packet count and the second sets capture duration.
-i lo chooses where to capture, while host 127.0.0.1 selects matching conversations.
The first selects source traffic and the second selects destination traffic only.