To get the HTTP Header informations for specific clients connections use ngrep and a pattern or a regular expression that will match the packets.
install ngrep (example for debian / ubuntu):
apt-get install ngrep
These examples dumps HTTP header for any connection matching the string “images” on port 80.
user@host:~# ngrep -qi -W normal '/images/' port 80 interface: lo (127.0.0.1/255.255.255.255) match: /images/ T 10.1.1.199:62073 -> 127.0.0.1:80 [AP] GET /images/globe_blogs.gif HTTP/1.1..Host: frederikkonietzny.de..User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; de; rv:1.9.2.12) Gecko/20101026 Firefox/3 .6.12..Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8..Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3..Accept-Encoding: gzip,deflate..Ac cept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7..Keep-Alive: 115..Connection: keep-alive..Cookie: …[Read more]