I'm on Ubuntu 18.04. I'm debugging an application that communicates with a remote server and I'd like to be able to directly view the bytes sent from my machine (rather than relying on debug output). Is there a way to do this?
View traffic that was already sent from your box? Not possible. You could infer the traffic based on what logs you have at the server side(if you have access to that server, but you will view the "Application Layer")
You could launch
tcpdump before starting a connection to have all that traffic logged to a file. Example:
tcpdump -i eth0 -w /tmp/tcpdump.pcap host IP.OF.THE.SERVER
With the keyword
tcpdump will filter to save only traffic that has the server you are connecting to as source or destination. This will avoid creating big files with all traffic of your network.
-i stands for network interface and it requires a valid network interface and
-w stands for "write raw packets to file" and it will require a valid path with write permissions.
This will create a
.pcap file of all that traffic that can later be viewed with Wireshark if you want a nice GUI tool. If you want to read that file using
tcpdump there is already a pretty good answer here:
If you are a native english speaker, creating more strict filter is just a matter of adding additional objects to
tcpdump [expression] . Example to isolate the filtered host by destination and port to 80:
tcpdump -i eth0 -w /tmp/tcpdump.pcap dst host IP.OF.THE.SERVER and dst port 80