Wireshark

Search by string in Wireshark

1. Navigate to Edit -> Find Packet

2. Left-click on Packet list and then click Packet bytes

3. Select String on the third drop-down menu and specify auth-session on the field next to it. Finally, click Find. Wireshark will present you with the packets that include an auth-session string.

4. The cookie can be copied by right-clicking on a row that contains it, then clicking on Copy and finally clicking Value.