Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have web app installed on apache server(port 80, no ssl). This apps job is to gather some information via transferred from clients files. My goal is to check if my clients are sending proper files. So I want to capture files transferred to my Apache and then check if data format is proper.

I starting tcpdump like this: tcpdump -s0 -i eth0 'port 80' -vv but the output is not what I want.

Is it possible with tcpdump running on the same server?

share|improve this question
I think it should be your web application the one performing validation of the files it's processing. Can you modify it to do so? – dawud Aug 26 '13 at 12:36
No I'm not developer of this app ... in fact I am not developer at all :) I'm admin of server on wich this app runs. – B14D3 Aug 26 '13 at 12:48

I think you want netcat (nc), tcpdump is for debugging at the packet level, nc is for redirecting network traffic.

This is non-trivial (because of security issues) but the steps are

  1. Move your webserver to another port
  2. Have nc listen on port 80
  3. dump incoming traffic on port 80 to a log AND redirect it to the new port your webserver is listening to

This page has a more detailed write up on how to do it.

Finally there are 2 versions of netcat. Make sure you have the one that lets you violate pretty much every known security rule and keep in mind only root can listen on ports lower than 1024.

Edit: tcpdump can do what you are looking for but it's not going to be as strait forward - it's giving you the actual packets, you sound like you just want the HTTP text. To do it with tcpdump you'll want to dump it and then open the dump file in something like wireshark.

share|improve this answer
What do you mean redirect .... because in way I understand this will redirect trnsfered files and they will never reach app ?? If my understanding is correct then this way is not acceptable. – B14D3 Aug 26 '13 at 12:50
No, you use tee to do this. Netcat takes the data, splits the stream in two and sends one to the log and the other to the http server. – TheFiddlerWins Aug 26 '13 at 12:52
OK I will check this solution THX. – B14D3 Aug 26 '13 at 12:53

Wireshark is more convenient for such a task. You can run cli version, tshark to capture network traffic to a file, then copy it to your PC, open with GUI wireshark, find needed request and export using export objects.

Wireshark also support tcpdump files, made with -w flag

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.