I'm using ngrep for checking out http headers, I've never managed to get something transparent out of tcpdump and I don't like GUI apps like wireshark. ngrep is great, but I can't seem to find a way to grep headers of POST requests and content of their bodies ... Could please anybody tell me how to do that, or suggests some other methods of printing headers and content of POST request bodies ?
What is the
ngrep command that you're using? The following will show you the body of POST requests (assuming the standard port 80).
ngrep "POST" tcp and port 80
Keep in mind that frequently POST data is encoded in some binary format (often gzip for compression) so you won't be able to read it just by watching the