using tcpdump i would like to filter the responses that comes back from a squid cache server to only the responses that came back from the cache. that means that i need to filter according to the X-CACHE header value, if it's value is HIT, i should show it, otherwise the response is not from the cache. any idea what should my tcpdump filter be ?
Have you considered using ngrep instead of tcpdump?
It appears tcpdump can only match packet content for certain bytes, not arbitrarily search a packet for a string. Look at this advanced filter list for some guidance.
A workaround: If you add
-s0 -A -w - (show entire packets, ASCII, write to standard output) to your tcpdump params, you can then use grep with some context to show only the packets that show where X-Cache: HIT.
I don't believe that is possible. You could capture all traffic on the correct port / ip combination and then filter it using wireshark or similar.
You could also use ngrep (think grep for your network)
For this type of problem though i typically resort to using libpcap and ruby to write a quick script. You can then record only the packets you require or indeed only the information from the packets you require.
With ruby it's quite painless, i'm sure python or similar would also be straightforward.