Capturing http traffic

http_traffic.md

apt-get -y install ngrep tcpflow httpry scapy tshark

httpry

ngrep -l -q -d eth0 "^GET|^POST " tcp and port 80

tcpflow -p -c -i eth0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*'

tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

Capturing with Go and BPF

Capturing with eBPF and Python

Awesome pcap tools

BPF the forgotten bytecode

Tools for debugging, testing and using HTTP/2

Introducing gobpf - Using eBPF from Go