using tcpdump i would like to filter the responses that comes back from a squid cache server to only the responses that came back from the cache. that means that i need to filter according to the X-CACHE header value, if it's value is HIT, i should show it, otherwise the response is not from the cache. any idea what should my tcpdump filter be ?

migrated from stackoverflow.com Sep 6 '10 at 15:07

This question came from our site for professional and enthusiast programmers.


Have you considered using ngrep instead of tcpdump?

  • no can do. the problem is that i am not using tcpdump, i am using my own executable that uses the pcap to monitor the traffic. in my own executable i can use the same filter as i use in tcpdump. ngrep or any other grep's wont help me. – Oded Sep 6 '10 at 11:05

It appears tcpdump can only match packet content for certain bytes, not arbitrarily search a packet for a string. Look at this advanced filter list for some guidance.

A workaround: If you add -s0 -A -w - (show entire packets, ASCII, write to standard output) to your tcpdump params, you can then use grep with some context to show only the packets that show where X-Cache: HIT.

  • wont help me, since i wrote my own program using pcap lib, that listen on my interfaces, and uses the same filters as tcpdump does, once i'll have the correct filter in tcpdump, i'll use it in my own program. i cant do grep inside my program or parse the packet content my self, since it badly hurts my performance, i was wondering if the tcpdump. – Oded Sep 6 '10 at 9:43

I don't believe that is possible. You could capture all traffic on the correct port / ip combination and then filter it using wireshark or similar.

You could also use ngrep (think grep for your network)

For this type of problem though i typically resort to using libpcap and ruby to write a quick script. You can then record only the packets you require or indeed only the information from the packets you require.

With ruby it's quite painless, i'm sure python or similar would also be straightforward.

  • 1
    Indeed. tcpdump is not a protocol-specific tool. For this, you have to use programs like dnscap for the DNS (I don't know for HTTP). – bortzmeyer Sep 18 '10 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.