1

I'm talking about all the traffic, including complete incoming and outgoing HTTP requests and responses.

I'm using the latest Ubuntu, Apache2 and PHP, and need both the headers and the page data--the whole nine yards.

I'm aware of mod_dumpio, but I'm only getting the headers logged that way, and not the rest of the data, such as any POSTed XML. Might there be some configuration I'm missing out on?

Sincere thanks for any help!

Improve this question
3
  • What are you trying to achieve?
    – Marcin
    Aug 28, 2010 at 18:52
  • I'm trying to achieve access to the FULL conversation between a device and a server for troubleshooting/debugging purposes.
    – bland328
    Aug 28, 2010 at 20:23
  • Also, I should note that I don't care (much) about performance, as this is for troubleshooting in a low-traffic, controlled environment.
    – bland328
    Aug 28, 2010 at 20:25

3 Answers 3

Reset to default
5

tcpdump perhaps?

...and then something to parse the dump into something useful. wireshark has the ability to interpret packets from a tcpdump packet dump as a specific protocol

Improve this answer
2

You can try DumpIO module with:

DumpIOInput On
DumpIOOutput On
Improve this answer
0

Mirroring the outside webserver port on the switch and capturing that data from the mirrored port via tcpdump (as the previous answerer alluded to) is an option... using the mirrored port to another box dedicated to tcpdump will avoid killing the performance of your web server.

That might be overkill, depending on your bandwidth, but it's something to consider possibly.

"tcpdump -i eth0 -w webdata.pcap" is the command to use eth0 and write to the webdata.pcap file, if I remember right. I'm building a CentOS VM to play with now, so I have access to a Linux environment. If I'm wrong about that command I'll edit later.

Improve this answer
3
  • Great-sounding advice, thanks...it appears to have gotten the raw data recorded! Now, time to parse it. I'm new to Linux, but still can't believe I didn't get to know tcpdump after all the googling I've done on this topic. Does anyone have a favorite parser for tcpdump logs? Sawmill? Snort? Wireshark? My #1 priority is to yank the HTTP conversation out in chronological order, and not to learn the world's most powerful TCP analysis tool, if avoidable :)
    – bland328
    Aug 28, 2010 at 21:00
  • Oh, and I should mention that I'm open to doing the analysis under Ubuntu or Windows.
    – bland328
    Aug 28, 2010 at 21:02
  • Wireshark can open the pcap file that tcpdump creates, and it's my favorite :) It takes some getting used to, but you can filter down to 'just HTTP conversations' and you can step through entire TCP conversations. Runs under Ubuntu or Windows as well.
    – Eric Gearhart
    Aug 29, 2010 at 1:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .