Skip to content

Instantly share code, notes, and snippets.

@lilongen

lilongen/tcpdump-http-capture

Created April 26, 2016 07:07
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save lilongen/03b52b1877e2c4693e87ea4521bb5ec4 to your computer and use it in GitHub Desktop.
Save lilongen/03b52b1877e2c4693e87ea4521bb5ec4 to your computer and use it in GitHub Desktop.
Download ZIP
tcpdump http data packet capture examples
Raw
tcpdump-http-capture
#dump http response
tcpdump -s 0 -A 'src port 80 and tcp[((tcp[12:1]&0xf0)>>2):4]=0x48545450'
tcpdump -s 0 -A 'src port 80 and tcp[((tcp[12:1]&0xf0)>>2):4]='$(python -c "print '0x' + ''.join(hex(ord(i))[2:] for i in 'HTTP')")
#dump http post request, following two are equal, 0x504f5354 <-> POST
tcpdump -s 0 -A 'dst port 80 and tcp[((tcp[12:1]&0xf0)>>2):4]=0x504f5354'
tcpdump -s 0 -A 'dst port 80 and tcp[((tcp[12:1]&0xf0)>>2):4]='$(python -c "print '0x' + ''.join(hex(ord(i))[2:] for i in 'POST')")
#dump http get request
tcpdump -s 0 -A 'dst port 80 and tcp[((tcp[12:1]&0xf0)>>2):4]='$(python -c "print '0x' + ''.join(hex(ord(i))[2:] for i in 'GET ')")
tcpdump -e -s 0 -A 'dst port 80 and tcp[((tcp[12:1]&0xf0)>>2):4]='$(python -c "print '0x' + ''.join(hex(ord(i))[2:] for i in 'GET ')")' and tcp[(((tcp[12:1]&0xf0)>>2)+4):4]='$(python -c "print '0x' + ''.join(hex(ord(i))[2:] for i in '/v1/')")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment