title: In tools like tcpdump, when exactly are the network packets captured?
body: <p>One of the tools I am using uses encryption/decryption to send out data over the network. I am modifying the tool and I need to be sure that the data is actually being sent in an encrypted form.</p>
  
  <p>Are <strong><a href="http://www.wireshark.org/" rel="noreferrer">Wireshark</a></strong> and <strong><a href="http://en.wikipedia.org/wiki/Tcpdump" rel="noreferrer">tcpdump</a></strong> the right tools for the purpose? At which point during the transfer do they capture the network packets?</p>