Skip to content

Instantly share code, notes, and snippets.

@dacr

dacr/tcpdump.md

Last active July 31, 2023 14:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save dacr/0a62fe9bd51e1912c9d54918dfba4ab2 to your computer and use it in GitHub Desktop.
Save dacr/0a62fe9bd51e1912c9d54918dfba4ab2 to your computer and use it in GitHub Desktop.
Download ZIP
tcpdump cheat sheet / published by https://github.com/dacr/code-examples-manager #dc012b03-0968-4a22-adec-c9483bdab8c6/9af294dd1dbac76b4ac789383de5794632247810
Raw
tcpdump.md

tcpdump cheat sheet

dump HTTP requests and responses on standard output

sudo tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
sudo stdbuf -oL -eL /usr/sbin/tcpdump -A -s 10240 "tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)" | egrep -a --line-buffered ".+(GET |HTTP\/|POST )|^[A-Za-z0-9-]+: " | perl -nle 'BEGIN{$|=1} { s/.?(GET |HTTP\/[0-9.] |POST )/\n$1/g; print }'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment