On an AWS EC2 instance I needed to find the contents of the X-Forwarded-For header of incoming requests, send by CloudFront. The easiest way was to dump all incoming traffic on port 80:
sudo tcpdump -s 0 -X 'tcp dst port 80' -w dump.pcapI then copied the dump.pcap to my local machine and loaded it into Wireshark to read its contents.