Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I turn on tcpdump to capture requests going to my webserver. However, some of the requests are not captured by tcpdump but they showed up in apache access log. Those requests are usually long running request (~ 120 sec) with a large content length (~ 16300)

Here is my command for capture

sudo tcpdump -n -i any 'port 80 and dst 192.168.23.79' -w capture.cap -s0

What can I do to capture these type of requests?

share|improve this question
    
Is apache listening on other ports too? Can you add a line + the surrounding lines, that is missing in tcpdump? –  ott-- May 28 '13 at 11:31
    
apache only listen to port 80. How to add the + surrounding missing lines in tcpdump? –  Sean Nguyen May 28 '13 at 14:08
    
I mean, show the line from apache log and 2 lines above and below and the correspnding lines from tcpdump. –  ott-- May 28 '13 at 14:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.