```bash
tcpdump -i eth0 port 80
tcpdump -i any 'tcp and dst port 443 and (((ip[2:2] - ((ip[0]&0xf) << 2)) - ((tcp[12]&0xf0) >> 2)) != 0)' -w https.pcap
```
```bash
tcpdump -i eth0 port 80
tcpdump -i any 'tcp and dst port 443 and (((ip[2:2] - ((ip[0]&0xf) << 2)) - ((tcp[12]&0xf0) >> 2)) != 0)' -w https.pcap
```