How to use tcpdump to be able to see http requests sent to the server?

helptonewbie · 01-09-2009, 06:18 AM

Hi All,
Is it possible using tcpdump to display roughly the urls, or POST or GET data. I've got this command so far:-
tcpdump src host [ipaddress] and dst port http -XX

Which get output of:-

Code:

12:33:17.040750 IP [ipaddress].60667 > [hostname].http: P 5323:5952(629) ack 171139 win 65535 <nop,nop,timestamp 1016490840 153398489>
	0x0000:  0016 3e3e 19e7 0016 cbc9 b7ec 0800 4500  ..>>..........E.
	0x0010:  02a9 a308 4000 4006 39d7 ac16 0074 ac16  ....@.@.9....t..
	0x0020:  02cf ecfb 0050 fb7d f5d1 a513 528c 8018  .....P.}....R...
	0x0030:  ffff 3f52 0000 0101 080a 3c96 6b58 0924  ..?R......<.kX.$
	0x0040:  acd9 504f 5354 202f 6e61 6769 6f73 2f63  ..POST./nagios/c
	0x0050:  6769 2d62 696e 2f63 6d64 2e63 6769 2048  gi-bin/cmd.cgi.H

As you can see it displays part of the nagios URL there... what i'm trying to do is find out what POST/GET/URL nagios executes form the nagios web management when say clicking on the button in nagios that disables notifications for a specific host and service, etc. so unless there is another way to find this out, i'm trying to find the data i need by dumping the packet data. But not sure how i can get all the packet data i need from it. I can see small amount of the request but not all of it?

Cheers,
MJ

EDIT:- Well obviously i can see the PHP code page when clicking on the submit button is sending a POST, but i can't see all the entire request?

acid_kewpie · 01-09-2009, 06:36 AM

Well it says right there that it was a POST to that uri... isn't that *exactly* what you want? I think a -v should make it prettier, printing some level of formal decode compared to a dump. In general wireshark is a better option for elegantly pulling stuff like that apart.

helptonewbie · 01-09-2009, 06:36 AM

I've managed to get more data using the '-s' of tcpdump to not truncate output to 62 bytes as default but to capture whole packet. But this still didn't really give me the exact POST request that was sent. Perhaps i can't do what i want with this method?

Because at the end of the day i want to be able to in a script, run something like:-
curl --connect-timeout 4 --basic -u USER:PASSWORD http://NAGIOS/URL -d 'POST DATA'

To be able to start and stop notifications or checks using the nagios web page but via a script.

acid_kewpie · 01-11-2009, 04:27 PM

Something like a firefox extension may well be a simpler way to actually get the data in a useable form. plenty of developer extensions to track this sort of stuff.

helptonewbie · 01-12-2009, 09:33 AM

yes, perhaps that is a better method. I'll see what i can find. Cheers for the idea