I need to see whole HTTP packets sent and recieved by an application for debugging purposes. How can this be done in command-line?


Use tcpdump.

tcpdump -w httpdebug.pcap -i eth0 port 80 will sniff all packets heading to or from port 80 on the eth0 interface and output them to httpdebug.pcap, which you can then read at your leisure, either with tcpdump again (with multiple -x options, refer to the tcpdump manpage ) in console if you're feeling masochistic, or with wireshark.

I really can't recommend the latter highly enough, as it will let you sort out packets and follow the exact stream you want to see.

  • 3
    Be sure to add -s0 so you get the entire packet. It's usually truncated by default. – Cakemox Mar 4 '11 at 13:38

If you really want to use command line for this there is tcpflow. It saves TCP streams to different files. The HTTP request and responses will be stored separately.

tcpflow -i wlan0 tcp port 80

If you can use GUI try Wireshark. You can right click any packet and pick "Follow TCP stream".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.