I found a very nice command line shortcut today that helped me sniffing http packet headers on a remote server with tshark, the command-line version of the well-known wireshark:
tshark -i eth1 -R 'http' -S -V -l | awk '/^[HL]/ {p=30} /^[^ HL]/ {p=0} /^ / {--p} {if (p>0) print}'
credits: http://andy.wordpress.com/2008/07/10/sniffing-http/