How to get http requests details in a tcpdump?

Posted by tucson on Server Fault See other posts from Server Fault or by tucson
Published on 2012-03-30T11:23:42Z Indexed on 2012/03/30 11:31 UTC
Read the original article Hit count: 247

Filed under:

tcpdump

I am trying to get a tcpdump trace of some http requests.

Here is what I got so far (I replaced the real IP addresses with REMOTE and LOCAL):

C:\>Windump -na -i 3 ip host REMOTE and ip src LOCAL and tcp port 80
Windump: listening on \Device\NPF_{8056BE5E-BDBB-44E6-B492-9274B410AD66}
13:13:34.985460 IP LOCAL.4261 > REMOTE.80: . 1784894764:1784894765(1) ack 1268208398 win 65535
13:13:38.589175 IP LOCAL.4302 > REMOTE.80: F 3708464308:3708464308(0) ack 982485614 win 65535
13:13:38.589285 IP LOCAL.4303 > REMOTE.80: F 890175362:890175362(0) ack 2462862919 win 65535
13:13:38.589330 IP LOCAL.4304 > REMOTE.80: F 1838079178:1838079178(0) ack 156173959 win 65535
13:13:38.589374 IP LOCAL.4305 > REMOTE.80: F 3952718843:3952718843(0) ack 2209231545 win 65535
13:13:38.589413 IP LOCAL.4306 > REMOTE.80: F 446105750:446105750(0) ack 3141849979 win 65535
13:13:38.590265 IP LOCAL.4302 > REMOTE.80: . ack 2 win 65535
13:13:38.590403 IP LOCAL.4304 > REMOTE.80: . ack 2 win 65535
13:13:38.590429 IP LOCAL.4303 > REMOTE.80: . ack 2 win 65535
13:13:38.590484 IP LOCAL.4305 > REMOTE.80: . ack 2 win 65535
13:13:38.590514 IP LOCAL.4306 > REMOTE.80: . ack 2 win 65535

But I do not get the following level of details:

Request URL:http://domain.com/index.php Request Method:POST Status Code:200 OK POST /index.php HTTP/1.1 Host: domain.com Connection: keep-alive Content-Length: 151 Cache-Control: max-age=0 etc

How can I get this level of data?

Related posts about tcpdump

Packet loss rate with iperf and tcpdump

as seen on Server Fault - Search for 'Server Fault'
I tested a line for its link quality with iperf. The measured speed (UDP port 9005) was 96Mbps, which is fine, because both servers are connected with 100Mbps to the internet. On the other hand the datagram loss rate was shown to be 3.3-3.7%, which I found a little too much. Using a high-speed transfer… >>> More
tcpdump filter that excludes private ip traffic

as seen on Server Fault - Search for 'Server Fault'
For a generic filter to exclude all traffic in my dump that is between private IP address, I came up with the following: sudo tcpdump -n ' (not ( (src net 172.16.0.0/20 or src net 10.0.0.0/8 or src net 192.168.0.0/16) and (dst net 172.16.0.0/20 or dst net 10.0.0.0/8 or dst… >>> More
How to Break Up Large tcpdump Files

as seen on Server Fault - Search for 'Server Fault'
Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data? Like -C but after the fact. >>> More
tcpdump on dd-wrt router

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to capture packets from two devices on my network. I have tcpdump installed on my dd-wrt router and working correctly. However, the only packets I capture are broadcast packets when using a tcpdump statement that states only those two devices ./tcpdump -w /tmp/capture.pcap dst 192.168… >>> More
How can I log all traffic with its exact length?

as seen on Server Fault - Search for 'Server Fault'
I want to process all packets with their size going through our gateway server (running Debian 4.0). My idea is to use tcpdump, but I have two questions. The command I'm currently thinking of is tcpdump -i iface -n -t -q. Is it guaranteed that tcpdump will process all packets? What happens if… >>> More

Developer IT

How to get http requests details in a tcpdump? - Developer IT

How to get http requests details in a tcpdump?

tcpdump

Related posts about tcpdump

Packet loss rate with iperf and tcpdump

tcpdump filter that excludes private ip traffic

How to Break Up Large tcpdump Files

tcpdump on dd-wrt router

How can I log all traffic with its exact length?

Categories cloud