you don't need anything to read tcpdump files, it'll just write to stdout by default. if you wsih you can write to a file and then copy it to some other machine with ethereal and it will also open up fine there.

browsers do connect to port 80 for non-encrypted traffic, yes. but i don't understand what you mean about configuring the browser to connect to the router. is that using it as a proxy? if so why bother with the transparency??

I just tried to record the output of tcpdump because there was quite a lot of traffic on the interface where I ssh into my headless box!!! The output made little sense to me though, not really familiar with tos bits and all this yet....

What I mean is that if I configure the browser of my workstation to connect to port 80 of the proxy, then the box (netfilter + proxy on the same box) redirects the traffic to port 3128 for squid. If the browser of the workstation isn't configured to connect to a proxy then traffic isn't redirected!? Do you understand what I am trying to explain???
The reason why I bother trying to make it work transparent is that I want to filter the types of web contents. I will also want (when that transparency thing is sorted) to use QDISC to control the traffic....
The other thing is that it became a personnal matter to me since it is just not working the way I want it to work but not everyone might understand that

I'm off to work now.

Thanks