1

Is it possible to have tcpdump or some other app to log every outgoing request in simple format:

$time $host $remoteip $bytessent $bytesrecieved $responsecode

or any other common logging format, without request and response headers and body.

1

Not sure but can it be done by editing tcpdump syntax?

This article can be helpful in this case: https://www.computerhope.com/unix/tcpdump.htm

0

You can do some of this for unencrypted traffic (http rather than https) using ngrep (http://ngrep.sourceforge.net/) but (without a fair amount of work) you're only going to the requests and not the responses.

0

Put an iptables LOG rule in the OUTPUT chain. That way you can easily exempt commonly expected/whitelisted cinnections, things like RELATED traffic, the logs go to syslog (and thus easily off machine or into some SIEM) and you capture the data you require. Also, it doesn't require tcpdump to be running.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.