I did the same thing with Wireshark a while ago, but if my kernel ever dropped a packet, I would get corrupted media. I don't know if I was just doing something wrong, but I was running tcpdump (command line wireshark like program). It was run as root and I had increased the priority fairly high.
<-EDIT-> I think I figured out why I dropped so many packets. If you turn off DNS lookups, it doesn't drop anything.
Here's what I did:
sudo nice -n -15 /usr/sbin/tcpdump -n -i $net_if -s 0 -w - port 80 > output
Which creates a file called output in the current directory of all of your web traffic.
I then used chaosreader to convert the output file to all of the individual files that the traffic stream was:
nice chaosreader -r output
Caution, this creates a lot of files!
You can then look through those files for the file types that you like.
<-/EDIT->
It's not exactly the same thing, but I use an old python proxy for what you're talking about now.
I have updated it to work better on modern Linux/Python implementations, but I don't know what the license is so I can't really post anything yet. I've contacted the original dev to see if he could clarify what it means.
I'll keep you updated on what he comes back with and post the link to the bitbucket or github page for my updates.
