I need to capture all incoming/outcoming http traffic of a unix machine, and then run a script on each http header/body.

I have found that tcpdump captures all the requests, but big ones end up being split into multiple frames and is not easy to patch them together with a script that uses libpcap.

tcpflow almost does what I need, but it puts the whole flow between the host/client in the same file, without a good token to separate them making it impossible to know when a request ended and other started automatically.

Wireshark has the "follow http" option, but I couldn't find a way to use tshark to export one file for each flow.

Any suggestions?

  • Isn't this the job of the web server? Or of a proxy? – AlexP Mar 22 '17 at 23:20
  • use tcpick – Ipor Sircer Mar 22 '17 at 23:25
  • 1
    It's probably easier to force it through a transparent proxy using iptables instead of trying to reassemble all captured traffic. – dirkt Mar 23 '17 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.