Source.

tcpdump -l -n -i eth0 -w dump.pcap -s 65535 host www.example.com and port 80