I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use
tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every request to just the first received application-layer packet (the most significant packet in this case, which carries the HTTP request header and beginning of SOAP XML document). I want to know which
tcpdump switch (or combination of other linux commands) to use to get this first packet for each TCP connection, and drop the rest of packets received for the same connection.
If possible, having the first response packet (and probably the only, because in this application, response XML documents are small) sent from server to customer, would be nice too.
Currently I run
tcpdump -i any -A 'tcp port 80 and (((ip[2:2] - ((ip&0xf)<<2)) - ((tcp&0xf0)>>2)) != 0)' example from
tcpdump man page, so I don't get the TCP handshake packets.
And the problem with
-c switch is
tcpdump exits after capturing the packet, while I need it to stay running and continue showing the same information for new connections. Ideally I need something similar to
tailing apache access log files, along with first meaningful chunks of request and response.