如何使用tcpdump捕获所有HTTP数据包

Question

我想运行tcpdump一些参数(仍然不知道要使用什么),然后加载stackoverflow.com页面.

输出应该是HTTP通信.后来,我想将它用作shell脚本,所以每当我想检查站点site.com的HTTP通信时,我就可以运行了script.sh site.com.

HTTP通信应该足够简单.像这样:

GET /questions/9241391/how-to-capture-all-the-http-communication-data-using-tcp-dump
Host: stackoverflow.com
... 
...

HTTP/1.1 200 OK
Cache-Control: public, max-age=60
Content-Length: 35061
Content-Type: text/html; charset=utf-8
Expires: Sat, 11 Feb 2012 15:36:46 GMT
Last-Modified: Sat, 11 Feb 2012 15:35:46 GMT
Vary: *
Date: Sat, 11 Feb 2012 15:35:45 GMT


....
decoded deflated data
....

现在,我应该使用哪些选项tcpdump来捕获它？

Answer 1

它可以通过 ngrep

ngrep -q -d eth1 -W byline host stackoverflow.com and port 80 
       ^  ^       ^         ^        
       |  |       |         |
       |  |       |         |
       |  |       |         v
       |  |       |         filter expression
       |  |       |         
       |  |       +-->  -W  is set the dump format ("normal", "byline", "single", "none")
       |  |
       |  +---------->  -d  is use specified device instead of the pcap default
       |
       +------------->  -q  is be quiet ("don't print packet reception hash marks")

Answer 2

根据你提到的内容,ngrep(在Unix上)和Fiddler(Windows)可能是更好/更容易的解决方案.

如果您绝对想使用tcpdump,请尝试以下选项

tcpdump -A -vvv host destination_hostname

-A (ascii)
-vvv (verbose output)