If they are going across the loopback interface, you may have to tell tcpdump to read that interface. On Linux the interface is named lo, so you can use "-i lo". tcpdump -i lo port 7788