Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need assistance, I am trying to use tcpdump in order to capture API requests and responses between two servers, so far I have the following command:

tcpdump -iany -tpnAXs0 host xxx.xxx.xxx.xxx and port 6666

My problem is, that the output is still hard to read, because it sends the Headers, and the ack packets.

I would like to remove those and only see the XML bodies.

I tried to use grep -v, but apparently this is all one request, so it filters the entire thing...

Thanks!

share|improve this question
1  
TCPdumpt only dumps the network layer data, not applicaiton layer. so you have to wireshark to convert the tcpdump data to readable form. –  Farhan Sep 11 '12 at 13:56

1 Answer 1

How about this:

$ while read stream; do \
tshark -qz follow,tcp,ascii,$stream -r soap.pcap; done \
< <(tshark -R "xml" -T fields -e tcp.stream -r soap.pcap | sort | uniq)

Source: http://ask.wireshark.org/questions/18046/extracting-segmented-soap-xml-payload

share|improve this answer
    
hmmm, this doesnt work, I get error: tshark: The file "soap.pcap" doesn't exist. I understand you got it from that script where PCAP=$HOME/tmp/sample.pcap, but I am not sure how to adapt this to my situation... I dont have pcap file, I am trying to capture from a live stream. –  Carmageddon Jul 16 '13 at 13:54
    
Update: I think I understand what you meant after trying taking the script apart: tcpdump -iany -tpnAXs0 port 6666 | while read stream; do tshark -qz follow,tcp,ascii,stream -r soap.pcap; But this generates errors like: tshark: invalid -z argument. –  Carmageddon Jul 16 '13 at 14:09
    
Why not write the raw packets to a pcap file using -w, then you can filter them? tshark -v? –  quanta Jul 17 '13 at 3:21
    
if you could please give me a complete example of the full filter command, I would try. –  Carmageddon Jul 18 '13 at 5:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.