Another thing that I missed when running the code you mentioned is that POST payloads are getting stripped as well.

I managed to see the contents by commenting this line:
s/^\s+\S+\s+//; # remove initial address ind. #s/\s{2}.*//; # remove trailing dump <-- commented s/\s+//;
And redirecting the output to a file, then grepping it later. Is there a way of printing it along with the target?

EDIT: So far, I managed to get the values by modifying the regex line:
if (/^\S/) { while ($packet=~/(GET|POST|WWW-Authenticate|Authorization|[a-z]+=[a- +z]+).+/g) { ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst)=localti +me(time);
Basically, I extended the regex to capture a string followed by "=" and then string again.

But as you can see, it's not a concise solution, since it gets a lot of rubbish as well.

In reply to Re^2: converting tcpdump output by RnC
in thread converting tcpdump output by RnC

Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":