diff --git a/HowtoTcpdump.md b/HowtoTcpdump.md
index b6d36792..0499c3a5 100644
--- a/HowtoTcpdump.md
+++ b/HowtoTcpdump.md
@@ -123,3 +123,9 @@ en temps réel
 ~~~
 # tcpdump -n -ttt -e -i pflog
 ~~~
+
+* Récuper toutes les trâmes de type POST sur le port 80
+
+~~~
+# tcpdump -vv -s 0 -A 'tcp dst port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420 or tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504F5354 or tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x48545450 or tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x3C21444F' -w /home/user/capture.pcap
+~~~