tcpdump -r file.trace - tcp dst port 80
is, as you've discovered, not a valid tcpdump command. If you remove the extra
-, then you get
tcpdump -r file.trace tcp dst port 80
which is a valid tcpdump command, that will show you only traffic to TCP port 80. It will not show you traffic from TCP port 80, so, for example, if
file.trace has HTTP traffic to and from port 80, it will show you HTTP request traffic but NOT HTTP response traffic.
If you want to see traffic to and from port 80, use
tcpdump -r file.trace tcp port 80
However, if there's TCP traffic other than HTTP traffic to or from port 80, that will also be shown.
In addition, HTTP traffic not going to or from port 80, such as HTTP-over-SSL/TLS ("https") traffic, or traffic to ports such as port 8080, will not be shown. To, for example, see traffic to or from port 80 (for HTTP) and port 443 (for HTTPS), do
tcpdump -r file.trace tcp port 80 or 443
So what's "not working"?
Is it not showing, for example, HTTPS traffic? If so, you need to add port 443.
Is it not showing traffic to other ports? If so, you need to add those ports as well. Tcpdump can't recognize HTTP traffic (and Wireshark only recognizes it by port number).
Is it showing only requests, not responses? If you want to see responses, use
tcp port rather than
tcp dst port. If you only want to see requests, use
tcp dst port.