Today was yet another day studying and working with virtual networks in Qemu. I too seek to learn the way of the packet and upon my research I stumbled onto a great resource for learning tcpdump.

I also was reading up about the tun/tap interface. The two devices work on different levels of the networking stack. - TUN devices are layer 3, and are typically used for vpns - TAP devices are layer 2, and are typically used for virtualized networking.

Natural Born Coder: Understanding Tun Tap Interfaces