Capture traffic - sniff

Dos líneas bastan en Linux para capturar los paquetes GET y POST, tráfico http.

tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

tcpdump -X -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

Mas info aqui
https://sites.google.com/site/jimmyxu101/testing/use-tcpdump-to-monitor-http-traffic