Not able to get the required HTTP headers in tcpdump

StackOverflow https://stackoverflow.com/questions/9050796

  •  03-12-2019
  •  | 
  •  

Question

I am running a Django based http server and I am trying to collect the HTTP headers using tcpdump.

Here is the tcpdump command:

$ sudo tcpdump -i lo0 -s 0 -B 524288 port 8000

and here is the output

  19:55:55.388635 IP localhost.irdmi > localhost.50558: Flags [P.], seq 126:8318, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
  19:55:55.388649 IP localhost.50558 > localhost.irdmi: Flags [.], ack 8318, win 36734, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
  19:55:55.388657 IP localhost.irdmi > localhost.50558: Flags [P.], seq 8318:16510, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
  19:55:55.388666 IP localhost.50558 > localhost.irdmi: Flags [.], ack 16510, win 32638, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
  19:55:55.388673 IP localhost.irdmi > localhost.50558: Flags [P.], seq 16510:24702, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
  19:55:55.388682 IP localhost.50558 > localhost.irdmi: Flags [.], ack 24702, win 28542, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
  19:55:55.388687 IP localhost.irdmi > localhost.50558: Flags [.], seq 24702:41034, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 16332
  19:55:55.388691 IP localhost.irdmi > localhost.50558: Flags [P.], seq 41034:41086, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 52
  19:55:55.388707 IP localhost.50558 > localhost.irdmi: Flags [.], ack 41086, win 20350, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
  19:55:55.388714 IP localhost.irdmi > localhost.50558: Flags [P.], seq 41086:49278, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
  19:55:55.388722 IP localhost.50558 > localhost.irdmi: Flags [.], ack 49278, win 16254, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
  19:55:55.388728 IP localhost.irdmi > localhost.50558: Flags [P.], seq 49278:61630, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 12352
  19:55:55.388737 IP localhost.50558 > localhost.irdmi: Flags [.], ack 61630, win 10078, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0

Does anybody know what is the problem here? Why cannot I get the full HTTP headers for the request? I tried using wireshark, but I am getting some other errors there.

Was it helpful?

Solution

The command below works for me to grab http headers on port 8000. The -s will grab the first 1024 bytes so you can adjust to grab more or less packet data.

tcpdump -i eth0 -s 1024 -l -A port 8000

OTHER TIPS

If you want to see packet contents, you don't really want to use tcpdump.

Use tcpflow instead - that will show you the full requests. Or even better, use a browser extension such as firebug to view the headers on a much higher level than packet sniffing.

To sniff on port 8000 with tcpflow, use tcpflow -c port 8000. It will display all traffic on stdout.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top