tcpdump tcp port 80 -w output.pcap -i eth0
NOTE: This dumps data for port 80 on interface eth0, outputs to output.pcap.