I would like to have a http POST request method CAPTURE filter.
I know it is easy to do it by display filter
http.request.method==POST but I need tcpdump compatible.
tcp dst port 80 and (tcp = 0x18)
But it is not perfect...
tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)
works better, but... packages are not treated as a http packages, so I can not do my further display filters...
And is there any way to not display frame, tcp, ip and http header information, only data-text-lines field value (content of POST)?
Or same thing in tcpdump, only dumping of POSTed html form content?