I've been playing with tcpdump that is installed on my firewall, and I wanted to capture the username and password during the login session on a webpage, but after going through the packets in the capture I don't seen to find it... what should I be looking for and "http GET=" or something different?... or maybe that some pages the authentication process happens on the server side, and that's the reason why I'm not capturing username, and password.... any clarification appreciated

thanks