0

I have a simple API that listens on http://localhost:5000 and I have the Nginx as a reverse proxy that listens on https://example.com.

I have configured Nginx to send headers to my API:

    location /
    {
        proxy_pass http://localhost:5000;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;

    }

However, something doesn't work here as my JWT provider library redirects me to http:// instead of https://. I suspect that the problem might be in between Nginx and my API.

I want to have a simple command line utility to monitor or log HTTP traffic on my API port.

I saw these questions and it seems that none of them is suitable for my requirement (and they are very old too):

https://superuser.com/questions/604998/monitor-tcp-traffic-on-specific-port
I tried tcpdump and the output is not readable for me as a web developer. I'm looking for something like HTTPie output.

https://superuser.com/questions/23180/whats-the-easiest-way-to-sniff-tcp-traffic-data-on-linux
I want the headers in fact. This question is about the data itself.

https://askubuntu.com/questions/257263/how-to-display-network-traffic-in-the-terminal
All of these applications only show stats related to the network. Not the request/responses.

So, is there a simple utility that can output HTTP request/response headers and body and capture them and print them to the terminal or a file?

My server runs Debian 11.

3
  • tcpdump is probably the right tool here, though a less generalised tool might exist. The raw output is pretty terse, did you try processing it with a tool like wireshark?
    – bxm
    Commented Jul 2, 2023 at 8:09
  • @bxm, to be honest, no. I did not have a good experience using Wireshark in the past. It's extremely complicated. I'm looking for something like Fiddler. Commented Jul 2, 2023 at 8:20
  • You should look again at tcpflow as it will show the http headers, which is just data. Try something like sudo tcpflow -i lo -C dst port 5000 or src port 5000.
    – meuh
    Commented Jul 2, 2023 at 14:40

1 Answer 1

2

Unlike HTTPie or Fiddler, a packet capturer in between the proxy and the API server will have no direct way of knowing which packets are part of your debugging session and which might be unrelated requests.

I'd recommend capturing with tcpdump and analyzing the captured dump with Wireshark or similar. You'd want a command line like tcpdump -i any -Knpv -w /some/where/output.cap tcp port 5000.

With Wireshark, you can then open the dump file, choose any packet, and select "Follow -> TCP Stream" from the right-mouse-button quick menu. That should give you the conversation between the client and the server: the client request with all its headers, and the server response and its headers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .