Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I turn on tcpdump to capture requests going to my webserver. However, some of the requests are not captured by tcpdump but they showed up in apache access log. Those requests are usually long running request (~ 120 sec) with a large content length (~ 16300)

Here is my command for capture

sudo tcpdump -n -i any 'port 80 and dst' -w capture.cap -s0

What can I do to capture these type of requests?

share|improve this question
Is apache listening on other ports too? Can you add a line + the surrounding lines, that is missing in tcpdump? – ott-- May 28 '13 at 11:31
apache only listen to port 80. How to add the + surrounding missing lines in tcpdump? – Sean Nguyen May 28 '13 at 14:08
I mean, show the line from apache log and 2 lines above and below and the correspnding lines from tcpdump. – ott-- May 28 '13 at 14:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.