Skip to content

Instantly share code, notes, and snippets.

@zushane

zushane/httpdmonitor

Last active August 29, 2015 13:58
Show Gist options
  • Save zushane/10135707 to your computer and use it in GitHub Desktop.
Save zushane/10135707 to your computer and use it in GitHub Desktop.
Download ZIP
monitor httpd via tcpdump
Raw
httpdmonitor
# tcpdump filter for HTTP GET
sudo tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'
# tcpdump filter for HTTP POST
sudo tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'
@zushane
Copy link
Author

zushane commented Apr 9, 2014

GET looks for the bytes 'G', 'E', 'T', and ' ' (hex values 47, 45, 54, and 20) just after the TCP header.
POST looks for the bytes 'P', 'O', 'S', and 'T' (hex values 50, 4f, 53, 54) just after the TCP header.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment