tcpdump filters for HTTP GET & HTTP POST

来源：互联网发布：刘双军网络二胡教学15 编辑：程序博客网时间：2024/05/01 15:50

https://stackoverflow.com/questions/4777042/can-i-use-tcpdump-to-get-http-requests-response-header-and-response-body

There are tcpdump filters for HTTP GET & HTTP POST (or for both plus message body):

Run man tcpdump | less -Ip examples to see some examples

Here’s a tcpdump filter for HTTP GET:

sudo tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

Here’s a tcpdump filter for HTTP POST:

sudo tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

Monitor HTTP traffic including request and response headers and message body (source):

tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'tcpdump -X -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

For more information on the bit-twiddling in the TCP header see: String-Matching Capture Filter Generator (link to Sake Blok's explanation).

0 0