even more awesomeness: tshark can look inside your packets
So, now we know how to filter by IP and stuff, and use wireshark. Next, I want to tell you about tshark, which is a command line tool that comes with Wireshark.
tcpdump doesn't know about HTTP or other network protocols. It knows pretty much everything about TCP but it doesn't care what you put inside your TCP packets. tshark knows all about what's inside your TCP packets, though!
Let's say I wanted to spy on all GET requests happening on my machine. That's super easy with tshark:
$ sudo tshark -i any \
-Y 'http.request.method == "GET"' \
-T fields \
-e http.request.method -e http.request.uri -e ip.dst
GET /hello.html 22.214.171.124
GET /awesome.html 126.96.36.199
GET / 188.8.131.52