sudo(8) tcpdump(8) -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'
execute a command as another user
dump traffic on a network
-s     Snarf snaplen bytes of data from each packet rather than the  default  of  65535  bytes.   Packets
       truncated because of a limited snapshot are indicated in the output with ``[|proto]'', where proto
       is the name of the protocol level at which the truncation has occurred.  Note that  taking  larger
       snapshots  both  increases  the  amount  of  time  it  takes  to process packets and, effectively,
       decreases the amount of packet buffering.  This may cause packets to be lost.   You  should  limit
       snaplen  to  the  smallest number that will capture the protocol information you're interested in.
       Setting snaplen to 0 sets it to the default of 65535,  for  backwards  compatibility  with  recent
       older versions of tcpdump.
-A     Print each packet (minus its link level header) in ASCII.  Handy for capturing web pages.
source manpages: sudotcpdump