$ tcpdump -i eth0 -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | egrep --line-buffered "^........(GET |HTTP\/|POST |HEAD )|^[A-Za-z0-9-]+: " | sed -r "s/^........(GET |HTTP\/|POST |HEAD )/\n\1/g"
POST /m/upload HTTP/1.1
Connection: keep-alive
X-AppGW-Trace-Id: 31b9d52cec1a8f3c3a880e0711185f10
Host: dev-m.sansae.net
X-ORIGINAL-HOST: dev-m.sansae.net
Content-Length: 344117
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="96", "Google Chrome";v="96"
accept: */*
Content-Type: multipart/form-data; boundary=----abcdefghiklmn
Authorization: Bearer abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: https://dev-m.sansae.net
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://dev-m.sansae.net/m/upload
Accept-Encoding: gzip, deflate, br
Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7
X-FORWARDED-PROTO: https
X-FORWARDED-PORT: 443
X-Forwarded-For: 52.231.xxx.xxx
X-Original-URL: /m/upload
Content-Disposition: form-data; name="file"; filename="test.txt"
Content-Type: text/plain
HTTP/1.1 200
x-muffin-trace-id: trace-1639043788060-e3982004-e88c-4996-9dbb-5f225ef92c6a
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY
Date: Thu, 09 Dec 2021 09:56:28 GMT
Keep-Alive: timeout=60
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive