icmp

icmp.type == 8 || icmp.type == 0

tcp port 80

tcp.port == 80

http

dst tcp port 80

tcp.dstport == 80 && http

:: Script to save a wireshark trace
:: tshark -D to get interface id
@echo off
C:
cd C:TempNetTracing
set PATH=%PATH%;C:Program FilesWireshark
echo Tracing host 127.1 or 172.1.1.1 or 10.0.0.1

tshark.exe -i 4 -a duration:900 -S -f "tcp port 80" -w trace.cap