Monitoring outbound server http header information?

Question

What tool / function can we use on our linux server running CentOS to monitor the http headers that are sent from our application to another application on a different server? Looking for http header monitoring from server to server. My issue is I have no idea how to capture the data sent from the server, meaning the http headers sent via a post.

I have tried many methods and third party software's like fiddler2 and ieinspector and the list goes on, but they only seem to capture the client headers and not what is being sent out from the server. I just need to capture the string being sent out via a post function and what is being returned. Seems simple, yet in this case, I'm beyond lost and running out of time to resolve what should be a simple solution.

We can see the headers from the server to the client using fiddler2, however, our application is calling an api on a different server. So the sequence goes - client to server - server to server - server back to server - server back to client. We cannot tell if the http headers sent from our server to the other server are correct.

The other server's support personnel are unable to capture that information & are forcing us to uncover the data. We know what we think we are sending, but cannot verify it. What we want is a fiddler2 like tool that resides on our server to track this, that can monitor the server to server traffic. If fiddler2 can do this, please let us know how to do this.

Answer 1

The easiest thing would be to add logging to the application. Log the headers before sending and after receipt, then read the logs. That is the only thing that would be "simple". I'm assuming you cannot do that. There is obviously no way software on your browser will capture communications between two remote systems on the internet. Everything else is more complicated.

The most proper way to accomplish this, assuming you don't want to reassemble captured packets off the line (ala wireshark), is to set a proxy between the two applications. So your system doesn't connect to the remote one directly anymore, it connect to your local proxy. If it doesn't want to accept reconfiguration, you fool it (route their DNS locally back to the proxy, and the proxy connects to their real IP).

The proxy passes everything between the two essentially unaltered, but it gives you the chance to log whatever you want about the request and response. This is effectively the same as though you were able to examine the request/response on the switch somewhere between you.

Note this is an intrusive change and likely to break the application until you get it right. Therefore you should attempt it with a test server, which would probably be enough to establish the content in question. If you want to pursue it, I recommend nginx as your proxy daemon.

Answer 2

You can use wireshark or tcpdump as long as you have root access to the server.