TCPdump

SharkBait · 08-15-2005, 05:14 PM

Hi,

I've looked over the MAN pages for TCPdump and I am still unclear on how to look though traffice based on port.

I want to look at HTTP traffic (in and out) on eth0. But be able to read the headers.

I've seen it before when I could see the URL etc of the packet to see what people were trying to view.

How is this done with TCPdump?

Thank you

bushidozen · 08-15-2005, 05:27 PM

Hopefully, this will help:

Quote:

I just recently started using tcpdump to look at http traffic.
When I fire it up I usually do something like:

prompt> sudo tcpdump -s 3000 -w dumpfile.txt host somehost and
port 1234
prompt> hexdump -c dumpfile | less

This tells tcpdump to capture all of most ethernet packets (mtu
for ethernet is usually around 1500, so you should get all of each packet
with size 3000) and to dump the output to dumpfile.txt. It specifies that
you only care about traffic destined for the host named somehost and for
port number 1234. So to watch web traffic for host foo try:

prompt> sudo tcpdump -s 3000 -w dumpfile.txt host foo port 80

Then use hexdump to dump that crazy tcpdump output into human
readable ascii (or learn to read hex ;-). I am new at this too, so I hope
this helps.