Question

When Fiddler is not on Mac OS X or Ubuntu, and if we don’t install/use Wireshark or any other more heavy duty tools, what is a way to use tcpdump so that

1) It can print out

GET /foo/bar HTTP/1.1
    [request content in RAW text]
    [response content in RAW text]
POST /foo/... HTTP/1.1

this should be able to be done by tcpdump or by using tcpdump in a short shell script or Ruby / Python / Perl script.

2) Actually, it can be neat if a script can output HTML, with

GET /foo/bar HTTP/1.1
POST /foo/... HTTP/1.1

on the page, for any browser to display, and then when clicked on any of those lines, it will expand to show the RAW content like (1) above does. Click again and it will hide the details. The expansion UI can be done using jQuery or any JS library. The script may be short… possibly less than 20 lines? Does anybody know how to do it either for (1) or (2)?

Answer 1

Here are two tcpdump filters for HTTP GET & HTTP POST:

# tcpdump filter for HTTP GET 
sudo tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

# tcpdump filter for HTTP POST 
sudo tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'