You have to save all received traffic on a tcp port. But there was one process which already listen to that port.

=> use tcpdump :

sudo tcpdump -vv -x -X  -i <interface> 'port <port>' -w <output_file>

More pretty and analysable with Wireshark, => use dumpcap :

dumpcap -n -i <interface> -f "port <port>" -w <output_file>