I'm talking about all the traffic, including complete incoming and outgoing HTTP requests and responses.

I'm using the latest Ubuntu, Apache2 and PHP, and need both the headers and the page data--the whole nine yards.

I'm aware of mod_dumpio, but I'm only getting the headers logged that way, and not the rest of the data, such as any POSTed XML. Might there be some configuration I'm missing out on?

Sincere thanks for any help!

  • What are you trying to achieve? – Marcin Aug 28 '10 at 18:52
  • I'm trying to achieve access to the FULL conversation between a device and a server for troubleshooting/debugging purposes. – bland328 Aug 28 '10 at 20:23
  • Also, I should note that I don't care (much) about performance, as this is for troubleshooting in a low-traffic, controlled environment. – bland328 Aug 28 '10 at 20:25

tcpdump perhaps?

...and then something to parse the dump into something useful. wireshark has the ability to interpret packets from a tcpdump packet dump as a specific protocol


You can try DumpIO module with:

DumpIOInput On
DumpIOOutput On

Mirroring the outside webserver port on the switch and capturing that data from the mirrored port via tcpdump (as the previous answerer alluded to) is an option... using the mirrored port to another box dedicated to tcpdump will avoid killing the performance of your web server.

That might be overkill, depending on your bandwidth, but it's something to consider possibly.

"tcpdump -i eth0 -w webdata.pcap" is the command to use eth0 and write to the webdata.pcap file, if I remember right. I'm building a CentOS VM to play with now, so I have access to a Linux environment. If I'm wrong about that command I'll edit later.

  • Great-sounding advice, thanks...it appears to have gotten the raw data recorded! Now, time to parse it. I'm new to Linux, but still can't believe I didn't get to know tcpdump after all the googling I've done on this topic. Does anyone have a favorite parser for tcpdump logs? Sawmill? Snort? Wireshark? My #1 priority is to yank the HTTP conversation out in chronological order, and not to learn the world's most powerful TCP analysis tool, if avoidable :) – bland328 Aug 28 '10 at 21:00
  • Oh, and I should mention that I'm open to doing the analysis under Ubuntu or Windows. – bland328 Aug 28 '10 at 21:02
  • Wireshark can open the pcap file that tcpdump creates, and it's my favorite :) It takes some getting used to, but you can filter down to 'just HTTP conversations' and you can step through entire TCP conversations. Runs under Ubuntu or Windows as well. – Eric Gearhart Aug 29 '10 at 1:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.