LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 01-04-2008, 01:28 AM   #1
LinuxGeek
Member
 
Registered: Jun 2002
Posts: 302

Rep: Reputation: 31
Grabbing HTTP Headers via a Linux Bridge


Hi,
I was wondering if there was any way to capture all the HTTP headers passing through a Linux bridge. I know how easy it is to perform something like full capture, but I'm only interested in HTTP traffic. Furthermore, I don't want all the traffic. I just want to keep track of HTTP sites visited, etc. Preferably, I'd like to then store it in a database (for future analysis). I'd prefer to not run a proxy on this machine (no squid). Finally, if the machine fails for any reason, is there a way to get it to fail open without using a network tap? Thanks for your help.
 
Old 01-04-2008, 03:53 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
i'm not aware of any failopen dual nics, and you'd certainly need a dual nic card to gte anywhere near that.

just playing about i've got this...
Code:
tshark -i bond0 port 80 -V -R 'http.host' | awk '{if (/Source:.+\./) source=$0; if (/Destination:.+\./) dest=$0; if (/Host:/) print source dest $0}'
which should give you...

Code:
    Source: 10.224.36.30 (10.224.36.30)    Destination: 221.206.29.201 (221.206.29.201)    Host: news.bbc.co.uk\r\n
    Source: 10.224.36.30 (10.224.36.30)    Destination: 221.206.29.201 (221.206.29.201)    Host: news.bbc.co.uk\r\n
    Source: 10.224.36.30 (10.224.36.30)    Destination: 221.206.29.201 (221.206.29.201)    Host: stats.bbc.co.uk\r\n
    Source: 10.224.36.30 (10.224.36.30)    Destination: 221.206.29.201 (221.206.29.201)    Host: stats.bbc.co.uk\r\n
All i've got time for right now, but it may well change soon.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Why would a router/firewall strip unknown http headers? multiverse Linux - Software 4 07-27-2007 06:43 PM
Forging HTTP headers, OS fingerprinting, etc. ilan1 Linux - General 4 03-04-2006 07:40 PM
Referer HTTP Headers and Squid win32sux Linux - Networking 0 09-17-2005 03:02 PM
C++ calling linux command grabbing output wilso027 Programming 7 04-23-2004 07:19 AM
Server uptime - Http headers?? wizade Linux - General 2 02-19-2003 03:56 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:35 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration