wireshark / tshark

GUI / CLI packet analyzer (Kali / Debian). Authorized capture only.

$ sudo wireshark
$ sudo tshark -i eth0 -f "tcp port 80"
$ tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri
$ tshark -r capture.pcap -z conv,tcp