I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump
to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every request to just the first received application-layer packet (the most significant packet in this case, which carries the HTTP request header and beginning of SOAP XML document). I want to know which tcpdump
switch (or combination of other linux commands) to use to get this first packet for each TCP connection, and drop the rest of packets received for the same connection.
If possible, having the first response packet (and probably the only, because in this application, response XML documents are small) sent from server to customer, would be nice too.
Currently I run tcpdump -i any -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
example from tcpdump
man page, so I don't get the TCP handshake packets.
And the problem with -c
switch is tcpdump
exits after capturing the packet, while I need it to stay running and continue showing the same information for new connections. Ideally I need something similar to tail
ing apache access log files, along with first meaningful chunks of request and response.