Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need assistance, I am trying to use tcpdump in order to capture API requests and responses between two servers, so far I have the following command:

tcpdump -iany -tpnAXs0 host and port 6666

My problem is, that the output is still hard to read, because it sends the Headers, and the ack packets.

I would like to remove those and only see the XML bodies.

I tried to use grep -v, but apparently this is all one request, so it filters the entire thing...


share|improve this question
TCPdumpt only dumps the network layer data, not applicaiton layer. so you have to wireshark to convert the tcpdump data to readable form. – Farhan Sep 11 '12 at 13:56

How about this:

$ while read stream; do \
tshark -qz follow,tcp,ascii,$stream -r soap.pcap; done \
< <(tshark -R "xml" -T fields -e -r soap.pcap | sort | uniq)


share|improve this answer
hmmm, this doesnt work, I get error: tshark: The file "soap.pcap" doesn't exist. I understand you got it from that script where PCAP=$HOME/tmp/sample.pcap, but I am not sure how to adapt this to my situation... I dont have pcap file, I am trying to capture from a live stream. – Carmageddon Jul 16 '13 at 13:54
Update: I think I understand what you meant after trying taking the script apart: tcpdump -iany -tpnAXs0 port 6666 | while read stream; do tshark -qz follow,tcp,ascii,stream -r soap.pcap; But this generates errors like: tshark: invalid -z argument. – Carmageddon Jul 16 '13 at 14:09
Why not write the raw packets to a pcap file using -w, then you can filter them? tshark -v? – quanta Jul 17 '13 at 3:21
if you could please give me a complete example of the full filter command, I would try. – Carmageddon Jul 18 '13 at 5:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.