using tcpdump i would like to filter the responses that comes back from a squid cache server to only the responses that came back from the cache. that means that i need to filter according to the X-CACHE header value, if it's value is HIT, i should show it, otherwise the response is not from the cache. any idea what should my tcpdump filter be ?
migrated from stackoverflow.com Sep 6 '10 at 15:07
I don't believe that is possible. You could capture all traffic on the correct port / ip combination and then filter it using wireshark or similar.
You could also use ngrep (think grep for your network)
For this type of problem though i typically resort to using libpcap and ruby to write a quick script. You can then record only the packets you require or indeed only the information from the packets you require.
With ruby it's quite painless, i'm sure python or similar would also be straightforward.
It appears tcpdump can only match packet content for certain bytes, not arbitrarily search a packet for a string. Look at this advanced filter list for some guidance.
A workaround: If you add