Now I see and yes, it's a tcpdump-related issue. I run an older tcpdump (package for Slack 9.0), and it basically misses all beautifying around the raw data: the address-indicator at the beginning and the plain dump at the end of each line.

A quick hack could be the following. Please note that I'm currently not in the condition of testing it (momentarily in a Win32 environment):

#!/usr/bin/perl

$LIMIT = shift || 5000;

$|=1;
open (STDIN,"/usr/sbin/tcpdump -lnx -s 1024 dst port 80 |");
while (<>) {
    if (/^\S/) {
    last unless $LIMIT--;
    while ($packet=~/(GET|POST|WWW-Authenticate|Authorization).+/g)  {
        print "$client -> $host\t$&\n";
    }
    undef $client; undef $host; undef $packet;
    ($client,$host) = /(\d+\.\d+\.\d+\.\d+).+ > (\d+\.\d+\.\d+\.\d+)/
        if /P \d+:\d+\((\d+)\)/ && $1 > 0;
    }
    next unless $client && $host;
    s/^\s+\S+\s+//; # remove initial address ind.
    s/\s{2}.*//;    # remove trailing dump
    s/\s+//;
    s/([0-9a-f]{2})\s?/chr(hex($1))/eg;
    tr/\x1F-\x7E\r\n//cd;
    $packet .= $_;
}
[download]