For listening to HTTP traffic with
tcpdump, and seeing the actual packets contents, you can do it with:
sudo tcpdump -X -s 1500 "port 80 and host mysite.example.com"
However, filtering on data can only be done at specific packet positions in
tcpdump and is not viable on this case.
So in addition, you can use also
ngrep to listen for lines with the specific string data on the network interface.
sudo ngrep -q "Private-Token: aaaaaaaaaaaaaa" "port 80 and host mysite.example.com"
As for the actual host/port filters, see this (short) summary about
tcpdump/BPF filters: TCPDUMP expressions
wireshark @StephenHarris recommendation, is quite good, for having a graphical interface. To do a
tcpdump writing raw data in a file for later use in
wireshark, you do:
sudo tcpdump -X -s 1500 "port 80 and host mysite.example.com" -w mycapture.pcap
You can also capture the packet requests at application level, using
sysdig. (Not so sure about the answers without testing)
sudo sysdig -s 2000 -A -c echo_fds fd.port=80 and evt.buffer contains "Private-Token: aaaaaaaaaaaaaa"