2

Every now and then;
I like to fire up tcpdump and just watch the network traffic as the packets flow on by.

For example:

user@host:~$ sudo tcpdump -Aevvv

Will parse & print all local network-traffic to the standard output, in real time, instead of writing (saving) to file. It's great for taking a quick glimpse at what's happening on the local network.

It's not uncommon to find packets coming through in larger quantities/at higher speeds than what is comfortable to parse and/or read. In such cases, I usually indicate a desired target host like so:

user@host:~$ sudo tcpdump -Aevvv host security.stackexchange.com

Obviously, the desired target host in this example is security.stackexchange.com. This is for no reason other than being the first to come to mind and can, of course, be set to any host you like. Using the host filter can clean up the results quite nicely, but I would like to take it one step further and specify certain HTTP Web Request types such as HEAD, GET, POST, & so on.

To continue in the spirit of our example, I would like to specify a tcpdump packet-filter rule for capturing HTTP POST Requests; so as to demonstrate what's happening behind the scenes when submitting content to a remote host like security.stackexchange.com.

So that is my question: (When using tcpdump..)
How can I specify a filter for POST Request packets only?

3

You can't for various reasons:

  • tcpdump has no idea of application level protocols.
  • That this is a TCP connection containing a POST is only known after the TCP handshake is already done, that is you either would loose the connection setup or you would need to capture everything and store it somewhere in case it might turn out to be a POST later.
  • There can be multiple HTTP requests inside a TCP connection and the POST might not be the first one.

Note that you might try to capture only the packets starting with "POST" as proposed in a different answer. But, this will capture also other packets starting with POST (and not only the POST requests), will not capture the payload in most cases (only if it is really small and contained in the same package) and will not capture the response.

Instead I recommend to capture all the traffic which might contain a POST and then later filter the captured traffic using wireshark/tshark, see https://serverfault.com/questions/309515/how-to-make-wireshark-filter-post-requests-only

  • 1
    There's also a command line version you called t-shark. You can find more info on it here: kvz.io/blog/2010/05/15/analyze-http-requests-with-tshark – Lucas Kauffman Sep 20 '15 at 6:59
  • But I also -1 because you can filter with tcpdump :) – Lucas Kauffman Sep 20 '15 at 7:00
  • @LucasKauffman: tshark (not t-shark!) is actually mentioned in my answer and the filter with tcpdump has the problems I've added in the comment to your response. – Steffen Ullrich Sep 20 '15 at 8:04
  • ooooh, can you edit your question a bit so I can upvote :) – Lucas Kauffman Sep 20 '15 at 8:06
  • 1
    @tjt263: As I've written you might capture other things and you might not capture the full payload and you don't get the response this way. If you can live with these restrictions it is a lightweight option. And if you like the capabilities of wireshark but prefer the CLI simply use tshark. – Steffen Ullrich Nov 2 '15 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.