Skip to content

Instantly share code, notes, and snippets.

@adler
Last active September 29, 2017 15:16
Show Gist options
  • Save adler/0707e600ac49a58a74c0e426339d9c12 to your computer and use it in GitHub Desktop.
Save adler/0707e600ac49a58a74c0e426339d9c12 to your computer and use it in GitHub Desktop.
goreplay only parsing GETs, not POSTs
# I was able to capture all the http traffic on port 9740
$ sudo tcpdump -s0 -w madler-posts.pcap port 9740
# Here we can the health checks that GET /version
$ tcpdump -r madler-posts.pcap -A port 9740 | grep GET | head
reading from file madler-posts.pcap, link-type EN10MB (Ethernet)
...w7Q.{GET /version HTTP/1.1
....7Q..GET /version HTTP/1.1
....7Q..GET /version HTTP/1.1
.5.B7Q..GET /version HTTP/1.1
# ... and here are the POSTs that are the traffic I want to replay
$ tcpdump -r madler-posts.pcap -A port 9740 | grep POST | head
reading from file madler-posts.pcap, link-type EN10MB (Ethernet)
....7Q.9POST ranker/latest?batch=true HTTP/1.1
...b7Q.0POST ranker/latest?batch=true HTTP/1.1
....7Q..POST ranker_eight_weeks/latest?batch=true HTTP/1.1
POST ranker/latest?batch=true HTTP/1.1
....7Q.|POST ranker_eight_weeks/latest?batch=true HTTP/1.1
....7Q..POST ranker_eight_weeks/latest?batch=true HTTP/1.1
...Y7Q..POST ranker/latest?batch=true HTTP/1.1
....7Q.iPOST ranker/latest?batch=true HTTP/1.1
....7Q..POST ranker/latest?batch=true HTTP/1.1
...n7Q..POST ranker/latest?batch=true HTTP/1.1
# ... but only the GET requests are detected by goreplay. The POST requests are missing
$ ./goreplay --input-raw madler-posts.pcap:9740 --output-stdout --input-raw-engine pcap_file
Version:
1 3494f2c79fe2575b05e2fd195ba6e95156c16493 1506696022393224000
GET /version HTTP/1.1
1 ea483274d98f7841bcc36366cc15c37115fc45a1 1506696022983410000
GET /version HTTP/1.1
1 4c4e42a3eff86092ebbecfaba6545ccc45f5043e 1506696023066051000
GET /version HTTP/1.1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment