In the Wireshark wiki is an example for filtering
HTTP GET requests:
Capture HTTP GET requests. This looks for the bytes 'G', 'E', 'T', and ' ' (hex values 47, 45, 54, and 20) just after the TCP header. "tcp[12:1] & 0xf0) >> 2" figures out the TCP header length. From Jefferson Ogata via the tcpdump-workers mailing list.
with this filter:
port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420
Unfortunately this does not work. How is the correct filter for
HTTP GET requests?