tcpdump

gistfile1.txt

	

Adjust the number of pre/post lines (-B and -A args) as needed:

tcpdump -n -S -s 0 -A 'tcp dst port 80' | grep -B3 -A10 "GET /url"

This lets you get the HTTP requests you want, on the box, without generating a huge PCAP file that you have to offload somewhere else.

Keep in mind, that the BPF filter is never exact, if there are a large number of packets flowing through any box, BPF can and will drop packets.