nc to examine vnc...etc.. traffic ?

I want to see what gnus is actually transacting with my ISP - sometimes.
So I'm trying to use nc.
Yes, there are always a thousand better ways, but if I sweep my nc-problems
umder the carpet, I can just as well become another WinTel-twitterer ?

So, using successive refinement, and starting simple, I've confirmed that
I can nc from one VT to another - both as root.
BTW it shouldn't matter that I have to `chroot <otherInstallation> nc` ?
-----> This seems ok
| setup client on one VT == to write to console: nc -l -p 3333
| & server on other VT ==
| nc 127.0.0.1 3333 < LRD {must use file in `pwd` }
| ==!! ok see contents of LRD on VT running: nc -l -p 3333
-----
So, the next step would be to listen on some IPort which I know/hope
has traffic other than one which is driven by nc.

Without paying to go online via dialup, I understand that vnc also
uses tcp/IP, so nc should be able to inspect the vnc traffic ?

I start with `vncserver`. And then start the vnc-client [on the same box]
which runs under linux-Oberon, and I can do linux stuff in an oberon
display, under vnc.

Now lsof shows:
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
linux.obe 2778 root 23u IPv4 13913 TCP 127.0.0.1:1044->127.0.0.1:5901 (ESTABLISHED)
and from the previous painfull vnc investigations I've seen that vnc
talks on 127.0.0.1:5901, so I'd expect nc to detect some traffic there ?

But # chroot /mnt/disk nc -l -p 127.0.0.1:1044
and # chroot /mnt/disk nc -l -p 127.0.0.1:5901
both show no vnc activety, after I've done eg. a `ls` on
the vnc client.

So the vnc clent & server are communicating and nc is hopefully
looking at 127.0.0.1:5901 and/or 127.0.0.1:1044, but detects no traffic.

What am I doing wrong.

I understand that 'X' runs via IP/tcp; so could nc capture that ?

== TIA.