My server runs curl commands to some API using a token. For example:

curl --header "Private-Token: aaaaaaaaaaaaaa" http://mysite.example.com/api/v4/any

Can i capture with tcpdump all of the requests to that API with this a specific token? If so, How? Other ideas will be great as well.

  • If curl is making the requests and getting the answer, why not saving the answer? Why using tcpdump at all? Jan 2, 2019 at 17:35
  • I just want to investigate something using tcpdump. That's is.
    – Omri
    Jan 2, 2019 at 17:44

1 Answer 1


For listening to HTTP traffic with tcpdump, and seeing the actual packets contents, you can do it with:

sudo tcpdump -X -s 1500 "port 80 and host mysite.example.com"

However, filtering on data can only be done at specific packet positions in tcpdump and is not viable on this case.

So in addition, you can use also ngrep to listen for lines with the specific string data on the network interface.

sudo ngrep -q "Private-Token: aaaaaaaaaaaaaa" "port 80 and host mysite.example.com"

As for the actual host/port filters, see this (short) summary about tcpdump/BPF filters: TCPDUMP expressions

Also, the wireshark @StephenHarris recommendation, is quite good, for having a graphical interface. To do a tcpdump writing raw data in a file for later use in wireshark, you do:

sudo tcpdump -X -s 1500 "port 80 and host mysite.example.com" -w mycapture.pcap

You can also capture the packet requests at application level, using sysdig. (Not so sure about the answers without testing)

sudo sysdig -s 2000 -A -c echo_fds fd.port=80 and evt.buffer contains "Private-Token: aaaaaaaaaaaaaa"
  • See also wireshark which can capture data, or read pre-saved tcpdump pcap files, and filter on contents. Jan 2, 2019 at 18:03
  • @StephenHarris wireshark for a graphical interface is a good recommendation. Jan 2, 2019 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.