Capture http token with tcpdump

Question

My server runs curl commands to some API using a token. For example:

curl --header "Private-Token: aaaaaaaaaaaaaa" http://mysite.example.com/api/v4/any

Can i capture with tcpdump all of the requests to that API with this a specific token? If so, How? Other ideas will be great as well.

Answer 1

For listening to HTTP traffic with tcpdump, and seeing the actual packets contents, you can do it with:

sudo tcpdump -X -s 1500 "port 80 and host mysite.example.com"

However, filtering on data can only be done at specific packet positions in tcpdump and is not viable on this case.

So in addition, you can use also ngrep to listen for lines with the specific string data on the network interface.

sudo ngrep -q "Private-Token: aaaaaaaaaaaaaa" "port 80 and host mysite.example.com"

As for the actual host/port filters, see this (short) summary about tcpdump/BPF filters: TCPDUMP expressions

Also, the wireshark @StephenHarris recommendation, is quite good, for having a graphical interface. To do a tcpdump writing raw data in a file for later use in wireshark, you do:

sudo tcpdump -X -s 1500 "port 80 and host mysite.example.com" -w mycapture.pcap

You can also capture the packet requests at application level, using sysdig. (Not so sure about the answers without testing)

sudo sysdig -s 2000 -A -c echo_fds fd.port=80 and evt.buffer contains "Private-Token: aaaaaaaaaaaaaa"