Ethereal / Wireshark

(dst port 80 && dst net != 192.168.10) || (src port 80 && src net ! 192.168.10) || (dst port 30102 && dst net 192.168.10) || (src port 30102 && src net 192.168.10)

In this scenario, we have a proxy server listening on port 30102. The first group captures traffic from the proxy to the origin server (destination port 80 and destination address is a public IP). The second group captures traffic from the origin server to the proxy (source port 80 and source address is a public IP). Third group captures traffic from the browser to the proxy. The fourth group captures traffic from the proxy to the browser.

http://www.wireshark.org/
http://home.insight.rr.com/procana/