1

I was wondering if its possible to capture all network traffic coming from a single website using tcpdump. I am interested in capturing the sizes of all incoming and outgoing packets from and to a certain website. However, something like tcpdump -n host washingtonpost.com will only (I tried this on the terminal) give the traffic coming from washingtonpost's directly resolved servers and not for example all the external CDNs, or the Advertising Servers et cetera. Since I do not know the IP addresses or hostnames of these servers beforehand, I cannot create a filter of somekind. Does anyone know of a way I could do this or whether this is indeed possible?

Thanks.

  • @steve I am doing this on the client side, that is just with my web browser, but thats a solution on the server end, right? – QPTR Mar 26 '17 at 10:11
3

This is not possible. Why ? Communication-Protocol http/https is the key here. tcpdump is "only" designated to capture lower level protocol. There is no filter on tcpdump to analyze traffic in-flight and do a expansion on the filter. But this would be necessary to meat your requirements.

You could use a Web-Proxy Cache or some other "in the middle" software. Also it is easy to impediment using Perl or Python scripts if HTTP would be the target. A little more work and in special with certificates in case of HTTPS.

+-------------+     +------------+     +------------+
| web-Browser |-----| HTTP/HTTPS |-----| HTTP/HTTPS |
+-------------+     | Proxy      |     | Server     |
                    +------------+     +------------+

You can use iptables on Linux do redirect all traffice to target port 80/443 to the web-proxy/"man in the middle"-program/script or use the proxy-parameter on you web-browser.

  • Thanks for the answer. So, basically, I have to create my own MITM proxy, redirect all the traffic there, and that way capture all the requests, but that would be on the HTTP layer, no? And I need packet sizes on the IP layer. Is that possible through this? (I have never used iptables before) – QPTR Mar 26 '17 at 10:10
  • Yes right - your focus should be on HTTP/HTTPS protocol. You don't have to care about packet size on IP layer to meet your requirements. You can use "sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 172.217.16.163:80" to redirect all outgoing traffic to port 80 - in this example to "goolge.de" – 0x0C4 Mar 26 '17 at 10:28
  • But how will I obtain the packet sizes in that case? – QPTR Mar 26 '17 at 10:38
  • 1
    "packet size" should be equal to the size of the request and response buffers. so in case of a web-proxy watch the access-log file. it will provide the length of the data. if you use a script/program just use the size information of the socket operation. – 0x0C4 Mar 26 '17 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.