The bpf filter you're using might actually be correct. It gets the data offset and looks right after it (i.e. the first bytes in the payload of the segment) for "GET
" which you have there in ASCII.
I tried your filter and it actually worked... for a very small subset of sites. The majority of traffic is now HTTPS not HTTP so finding raw GET
's in the wild is rarer.
Side note: wireshark which was mentioned in the comments is a good thought. Just in case you're not aware, tshark
(comes with wireshark) lends itself to automation and can do what you want:
tshark -Y 'http.request.method == GET'