Welcome to the forum. I use Wireshark when I want to examine network traffic and it works well under Tinycore.
I just fired it up to trace all traffic, and once I closed a chatty tab on my browser, the only traffic that showed up was
my machine sending an echo request to my server because I have a remote drive mounted followed by an ARP,
both with responses. This sequence repeats every 60 seconds. In addition, I know the Samba server I'm connected
to will announce itself every 15 minutes or so just like a Windows share would.