3

Im trying to save the rawdata that is beeing sent throu our proxy to a specific url. A friend of mine gave me the tip to use tcpdump, so I started reading about it on their page. But for some reason I fail to use it.

I tried 'tcpdump -c10 host my.very.specific.host.com' But I don't get any matches. And yes =) I can see that there is some kind of action from the client in the server.log.

If I use 'tcpdump -c10' I get 10 rows instantly. So I guess I miss understood the concept of 'host'?

I cannot point it towards a IP since the its a webserver that handles way to many different urls.

This is really not my domain(programmer) so, please excuse my simple question :) Thanks in advance.

EDIT 1

Thanks for all the help, and yes.. I should have stated my question more clearly. So here is some 'more' information. What I want to do is to capture the data going from our proxy to a cellphone.

The reason I'm doing this is to make sure that we send exactly what we want before it goes out into the 'mobile operator gateway/proxy wildness' (Yes they tend to modify things more then they should ;))

The information that I'm interested in is the http protocol.

So what I will do now is that I will try to dump the information that goes between our proxy and the mobile operator gateway on the 'public' NIC. Luckily for me the mobile operator only got one public gateway.

Over and out!

2
  • Where are you running this command? On server, proxy or client?
    – lexsys
    Jun 26, 2009 at 12:14
  • I'm running it on the proxy. Jun 26, 2009 at 12:30

6 Answers 6

6

You may have a problem with different interfaces. By default tcpdump only listens on the first ethernet interface it finds. If you add "-i any" it will listen on every interface.

As someone has mentioned already, you will end up capturing all the traffic to a particular ip address, regardless of the dns name you want. You can reduce the amount of data you capture by restricting the filter further. You could add a port and specify a particular remote host or network.

# tcpdump host 12.34.56.78 and port 80 and net 78.65.43.21/24 

You may find that tcpflow is more useful to you. It will dump each side of a TCP connection into a separate file. You can either use it with the same filter you'd use with tcpdump, or you can load a pcap file in. To save a pcap file, run:

# tcpdump -s 0 -w /tmp/dump.pcap -i any host 12.34.56.78 and port 80
1
  • Is the last example meant to say # tcpflow -s 0 -w /tmp/dump.pcap -i any host 12.34.56.78 and port 80? Nov 2, 2020 at 1:53
3

I'm going to try and say what LapTop006 said, but a little differently.

When you run that tcpdump -c10 host my.very.specific.host.com command, tcpdump is resolving "my.very.specific.host.com" to an IP address and filtering for traffic to that IP. If DNS returns multiple IP addresses for "my.very.specific.host.com", tcpdump is just going to take the first IP returned and filter for that IP.

If there are only a few IPs returned for ""my.very.specific.host.com", you could do:

tcpdump -c10 host 1.2.3.4 or host 2.3.4.5 or host 3.4.5.6

It would be easier to capture the traffic between the client and the proxy rather than between the remote web server and the proxy, since the client only has one IP address. (I suppose if what you're trying to see is interaction beteen the remote web server and the proxy, though, you'd need to capture that. Your post doesn't give me enough to go on...)

2
  • Alternatively to returning multiple RRs, it might return a completely different IP than the originating client is using, due to DNS views or host files.
    – Dan Carley
    Jun 26, 2009 at 11:55
  • You're quite right, albeit if the originating client is using this HTTP proxy then, typically, the originating client won't be doing any name resolution for the destination server itself. (I suppose that this could be a transparent proxy and the client could be doing name resolution... Not enough information to say...) Jun 26, 2009 at 12:10
1

I would try the (internal) IP address as argument for HOST.

by the way here is a tutorial http://linux.byexamples.com/archives/283/simple-usage-of-tcpdump/ and a cheat sheet (PDF) with all the options.

1
  • Thats a good tutorial for tcpdump-dummies, like me :) Jun 26, 2009 at 11:47
0

tcpdump always works at the IP layer, even if you give it a DNS name it simply resolves it to an IP

You could use the client's address as the host to consider.

The next step is to start capturing full packets to a "pcap" file that wireshark can open for full analysis.

1
  • The client is a mobile phone behind a proxy, so In this case it wont really narrow it down. Ill try the wireshark idea. Jun 26, 2009 at 11:46
0

In addition to what the others have said - use IP, correct interface, dump to pcap.

I would advise you to get rid of the -c10 flag. That instructs tcpdump to exit after receiving exactly 10 packets and that may not be sufficient for what you want to see.

0

You want to run tcpdump on the machine serving the web pages. Do not use a host address; you will be capturing traffic only to that host anyway. You want to capture to a file everything on port 80, and you want to make sure you capture all of the data, without truncating it. The command you want is:

sudo tcpdump -w log.pcap -s 65535 port 80

If your machine has multiple ethernet interfaces, you might have to specify the one to use to capture the traffic. If you find yourlself capturing no traffic, use ifconfig -a to see the list of interfaces and their addresses, chose the appropriate one, and add the -i eth1 (or whatever interface) options to the command line.

Once you have a pcap file, you need to analyze it. For interactive use, Wireshark is an excellent tool. Copy the pcap file to your workstation and run wireshark -r log.pcap. You can use the filters to find the packets that have "Host: some.server.of.interest.com" headers; those are the ones for the virtual host of interest. Analyze / Follow TCP Stream will show you the entire HTTP conversation in a very readable format.

If you want to do automated analysis, you'll probably have to write some custom code. One option would be to use a tool such as tcpflow to dump all of the HTTP sessions to files, and then use a scripting language (or even grep) to select the files of interest and analyze them. It's also not difficult to read pcap files directly, but doing re-assembly of the TCP conversations is a lot more work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .