I have a linux box acting as a router between many clients and the internet, and i need to pull some statistics on usage: I need to log which internal IPs access which addresses externally.
I use this to check which internal IPs access which external IPs:
tcpdump -n -i any port 80 or port 443 and src net 192.168.101.0/24
(I use -n and do the lookups later)
However, this also shows me a lot of extras relating to TCP handshaking and windowing. Is it possible to only show the actual HTTP request?
I have found a few approaches, most of which involve
GET\|POST, butthat strips away the IPs, which is primarily what i care about.
- I do not have the luxury of using anything else than tcp + standard linux and bash commands (hence why i'm limited to tcpdump and grep/strings/awk/sed
- Would including the filter
tcp & 2!=0'help, as i understand that would only show the initial SYN?