Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to see whole HTTP packets sent and recieved by an application for debugging purposes. How can this be done in command-line?

share|improve this question
up vote 9 down vote accepted

Use tcpdump.

tcpdump -w httpdebug.pcap -i eth0 port 80 will sniff all packets heading to or from port 80 on the eth0 interface and output them to httpdebug.pcap, which you can then read at your leisure, either with tcpdump again (with multiple -x options, refer to the tcpdump manpage ) in console if you're feeling masochistic, or with wireshark.

I really can't recommend the latter highly enough, as it will let you sort out packets and follow the exact stream you want to see.

share|improve this answer
Be sure to add -s0 so you get the entire packet. It's usually truncated by default. – Cakemox Mar 4 '11 at 13:38

If you really want to use command line for this there is tcpflow. It saves TCP streams to different files. The HTTP request and responses will be stored separately.

tcpflow -i wlan0 tcp port 80

If you can use GUI try Wireshark. You can right click any packet and pick "Follow TCP stream".

share|improve this answer
+1'ed because you can't recommend Wireshark enough. :) – Shadur Sep 21 '12 at 11:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.