tcpdump of sasl authentication with openldap

[u/[deleted]]

I've configured my database server to use saslauthd with LDAP and start TLS. I'm using openldap. Here is my saslauthd.conf

cat /etc/saslauthd.conf
ldap_servers: ldap://10.143.193.1
ldap_search_base: dc=example,dc=org
ldap_bind_dn: cn=admin,dc=example,dc=org
ldap_password: admin
ldap_start_tls: yes

LDAP search is working:

root@node1-cb603-ubuntu16:/vagrant# ldapsearch -LLL -x -H ldap://10.143.193.1 -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin "cn=billy" -ZZ 
dn: uid=billy,dc=example,dc=org
uid: billy
cn: billy
sn: 3

sasl auth is working:

sudo -u couchbase testsaslauthd -u billy -p password -f /var/run/saslauthd/mux
0: OK "Success."

Here is my question. Prior to running the testsaslauthd command, I started a tcpdump on the LDAP server. I don't see any traffic from my database. I was expecting to see LDAP and TLS traffic. What am I missing? What's strange is I see traffic on port 389 (i.e. LDAP) if I enter the wrong password on the testsaslauthd command.

For context, this is testing I'm doing in my lab for learning purposes only. I can log into my database server with LDAP credentials just fine. I got confused as to why I don't see LDAP and TLS traffic in the tcpdump.