You can do that with [ptcpdump](https://github.com/mozillazg/ptcpdump):
``` $ sudo ptcpdump -i any -c 2 port 80 2024/05/18 15:07:26 capturing... 15:07:32.109948 wlp4s0 Out IP (tos 0x0, ttl 64, id 19758, offset 0, flags [DF], ip_proto TCP (6), length 60) 192.168.1.50.48282 > 104.18.32.7.80: Flags [S], cksum 0x4a22, seq 638565084, win 64240, options [mss 1460,sackOK,TS val 3459351264 ecr 0,nop,wscale 7], length 0 Process (pid 1674620, cmd /usr/bin/curl, args curl stackoverflow.com) 15:07:32.520880 wlp4s0 In IP (tos 0x4, ttl 53, id 0, offset 0, flags [DF], ip_proto TCP (6), length 60) 104.18.32.7.80 > 192.168.1.50.48282: Flags [S.], cksum 0x56a1, seq 3079891173, ack 638565085, win 65160, options [mss 1400,sackOK,TS val 3122651013 ecr 3459351264,nop,wscale 13], length 0 Process (pid 1674620, cmd /usr/bin/curl, args curl stackoverflow.com) 2 packets captured 3 packets received by filter 0 packets dropped by kernel ```

[ptcpdump][1] can do that for you:
``` $ sudo ptcpdump -i any -c 2 dst host stackoverflow.com 2024/05/18 14:13:58 capturing... 14:14:23.563846 wlp4s0 Out IP (tos 0x0, ttl 64, id 56758, offset 0, flags [DF], ip_proto TCP (6), length 60) 192.168.1.50.48686 > 104.18.32.7.443: Flags [S], cksum 0x4a22, seq 2370274194, win 64240, options [mss 1460,sackOK,TS val 3456162718 ecr 0,nop,wscale 7], length 0 Process (pid 1100440, cmd /usr/bin/curl, args curl https://stackoverflow.com) 14:14:23.767565 wlp4s0 Out IP (tos 0x0, ttl 64, id 56759, offset 0, flags [DF], ip_proto TCP (6), length 52) 192.168.1.50.48686 > 104.18.32.7.443: Flags [.], cksum 0x4a1a, seq 2370274195, ack 149658868, win 502, options [nop,nop,TS val 3456162921 ecr 3104647973], length 0 Process (pid 1100440, cmd /usr/bin/curl, args curl https://stackoverflow.com) 2 packets captured 2 packets received by filter 0 packets dropped by kernel ```

[1]: https://github.com/mozillazg/ptcpdump