Which display filter searches full packet contents for any of the three credential-related terms?
frame contains "user" or frame contains "pass" or frame contains "login"
tcp.port == 443
frame contains "user" and frame contains "pass" and frame contains "login"
http