tshark

tshark.sh

sudo tshark  -i ens160 -T fields -E separator="|" -t e -Y "tcp.port == 80 and http.request and http.request.method == \"POST\" and http.request.full_uri matches \"wp\""    -e frame.time -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport  -e http.request.method -e http.request.full_uri -e data -e text

sudo tshark  -i ens160 -T fields -E separator="|" -t e -R "tcp.port == 80 and http.request and http.request.method == \"POST\" and   not http.request.full_uri matches \"webmail\"  "    -e frame.time -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport  -e http.request.method -e http.request.full_uri -e data -e text

sudo tshark  -i ens160 -T fields -E separator="|" -t e -R "tcp.port == 80 and http.request and http.request.method == \"POST\" and   not http.request.full_uri matches \"webmail\"  and   not http.request.full_uri matches \"sabinnet\" "    -e frame.time -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport  -e http.request.method -e http.request.full_uri -e data -e text

view post data

tshark  -i any -R 'tcp.port==80'      -Tfields -e ip.src    -e data -e text

tshark  -i  any -R 'tcp.port==80 && (http.request.method=="POST" &&  http.host == "www.mrchagh.com" )'     -Tfields -e ip.src    -e data -e text