如何使用 tcpdump 捕获所有 HTTP 数据包 [英] How to capture all the HTTP packets using tcpdump
本文介绍了如何使用 tcpdump 捕获所有 HTTP 数据包的处理方法,对大家解决问题具有一定的参考价值,需要的朋友们下面随着小编来一起学习吧!
问题描述
我想用一些参数运行tcpdump
(还是不知道用什么),然后加载stackoverflow.com页面.
I want to run tcpdump
with some parameters (still don't know what to use), then load the stackoverflow.com page.
输出应该是 HTTP 通信.后来我想把它当作一个shell脚本,所以每当我想检查站点site.com的HTTP通信时,我就可以运行script.sh site.com
.
Output should be the HTTP communication. Later, I want to use it as a shell script, so whenever I want to check the HTTP communication of a site site.com, I just can run script.sh site.com
.
HTTP 通信应该足够简单.像这样:
The HTTP communication should be simple enough. Like this:
GET /questions/9241391/how-to-capture-all-the-http-communication-data-using-tcp-dump
Host: stackoverflow.com
...
...
HTTP/1.1 200 OK
Cache-Control: public, max-age=60
Content-Length: 35061
Content-Type: text/html; charset=utf-8
Expires: Sat, 11 Feb 2012 15:36:46 GMT
Last-Modified: Sat, 11 Feb 2012 15:35:46 GMT
Vary: *
Date: Sat, 11 Feb 2012 15:35:45 GMT
....
decoded deflated data
....
现在,我应该与 tcpdump
一起使用哪些选项来捕获它?
Now, which options should I use with tcpdump
to capture it?
推荐答案
可以通过ngrep
ngrep -q -d eth1 -W byline host stackoverflow.com and port 80
^ ^ ^ ^
| | | |
| | | |
| | | v
| | | filter expression
| | |
| | +--> -W is set the dump format ("normal", "byline", "single", "none")
| |
| +----------> -d is use specified device instead of the pcap default
|
+-------------> -q is be quiet ("don't print packet reception hash marks")
这篇关于如何使用 tcpdump 捕获所有 HTTP 数据包的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!
查看全文