Home / server / Questions / 32115
In Process
Carl Bergquist
Asked: 2009-06-27 03:31:42 +0800 CST

Dumping rawdata for a host on a proxy using tcpdump

  • 772

Im trying to save the rawdata that is beeing sent throu our proxy to a specific url. A friend of mine gave me the tip to use tcpdump, so I started reading about it on their page. But for some reason I fail to use it.

I tried 'tcpdump -c10 host my.very.specific.host.com' But I don't get any matches. And yes =) I can see that there is some kind of action from the client in the server.log.

If I use 'tcpdump -c10' I get 10 rows instantly. So I guess I miss understood the concept of 'host'?

I cannot point it towards a IP since the its a webserver that handles way to many different urls.

This is really not my domain(programmer) so, please excuse my simple question :) Thanks in advance.

EDIT 1

Thanks for all the help, and yes.. I should have stated my question more clearly. So here is some 'more' information. What I want to do is to capture the data going from our proxy to a cellphone.

The reason I'm doing this is to make sure that we send exactly what we want before it goes out into the 'mobile operator gateway/proxy wildness' (Yes they tend to modify things more then they should ;))

The information that I'm interested in is the http protocol.

So what I will do now is that I will try to dump the information that goes between our proxy and the mobile operator gateway on the 'public' NIC. Luckily for me the mobile operator only got one public gateway.

Over and out!

proxy tcpdump

6 Answers

  1. You may have a problem with different interfaces. By default tcpdump only listens on the first ethernet interface it finds. If you add "-i any" it will listen on every interface.

    As someone has mentioned already, you will end up capturing all the traffic to a particular ip address, regardless of the dns name you want. You can reduce the amount of data you capture by restricting the filter further. You could add a port and specify a particular remote host or network.

    # tcpdump host 12.34.56.78 and port 80 and net 78.65.43.21/24

    You may find that tcpflow is more useful to you. It will dump each side of a TCP connection into a separate file. You can either use it with the same filter you'd use with tcpdump, or you can load a pcap file in. To save a pcap file, run:

    # tcpdump -s 0 -w /tmp/dump.pcap -i any host 12.34.56.78 and port 80
    • 6

  2. I'm going to try and say what LapTop006 said, but a little differently.

    When you run that tcpdump -c10 host my.very.specific.host.com command, tcpdump is resolving "my.very.specific.host.com" to an IP address and filtering for traffic to that IP. If DNS returns multiple IP addresses for "my.very.specific.host.com", tcpdump is just going to take the first IP returned and filter for that IP.

    If there are only a few IPs returned for ""my.very.specific.host.com", you could do:

    tcpdump -c10 host 1.2.3.4 or host 2.3.4.5 or host 3.4.5.6

    It would be easier to capture the traffic between the client and the proxy rather than between the remote web server and the proxy, since the client only has one IP address. (I suppose if what you're trying to see is interaction beteen the remote web server and the proxy, though, you'd need to capture that. Your post doesn't give me enough to go on...)

    • 3

  3. I would try the (internal) IP address as argument for HOST.

    by the way here is a tutorial http://linux.byexamples.com/archives/283/simple-usage-of-tcpdump/ and a cheat sheet (PDF) with all the options.

    • 1

  4. tcpdump always works at the IP layer, even if you give it a DNS name it simply resolves it to an IP

    You could use the client's address as the host to consider.

    The next step is to start capturing full packets to a "pcap" file that wireshark can open for full analysis.

    • 0

  5. In addition to what the others have said - use IP, correct interface, dump to pcap.

    I would advise you to get rid of the -c10 flag. That instructs tcpdump to exit after receiving exactly 10 packets and that may not be sufficient for what you want to see.

    • 0

  6. You want to run tcpdump on the machine serving the web pages. Do not use a host address; you will be capturing traffic only to that host anyway. You want to capture to a file everything on port 80, and you want to make sure you capture all of the data, without truncating it. The command you want is:

    sudo tcpdump -w log.pcap -s 65535 port 80

    If your machine has multiple ethernet interfaces, you might have to specify the one to use to capture the traffic. If you find yourlself capturing no traffic, use ifconfig -a to see the list of interfaces and their addresses, chose the appropriate one, and add the -i eth1 (or whatever interface) options to the command line.

    Once you have a pcap file, you need to analyze it. For interactive use, Wireshark is an excellent tool. Copy the pcap file to your workstation and run wireshark -r log.pcap. You can use the filters to find the packets that have "Host: some.server.of.interest.com" headers; those are the ones for the virtual host of interest. Analyze / Follow TCP Stream will show you the entire HTTP conversation in a very readable format.

    If you want to do automated analysis, you'll probably have to write some custom code. One option would be to use a tool such as tcpflow to dump all of the HTTP sessions to files, and then use a scripting language (or even grep) to select the files of interest and analyze them. It's also not difficult to read pcap files directly, but doing re-assembly of the TCP conversations is a lot more work.

    • 0