Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My application is sending HTTP requests to some server and I want to see the actual data that it is sending out. Some specifics I would like to see:

  • Request method (GET/POST/PUT, etc.)
  • Content-type
  • Body

What is the best and simple way to accomplish this?

share|improve this question
    
"method of request, content type, body and etc." Are you talking about HTTP-specific inspection? Is it HTTPS (secured) by any chance? –  gertvdijk Feb 6 '13 at 23:28
    
Yes, you're right but it's not sending by browser –  megas Feb 6 '13 at 23:31
    
Sorry, it's just HTTP requests –  megas Feb 6 '13 at 23:38
3  
Okay, that's fine then. Is it just one or a small set of servers it's talking to? And no other applications are talking to those servers? If both yes, then the answer about Wireshark is what I would go for. Learn how it works. It's not that hard. –  gertvdijk Feb 6 '13 at 23:40
    
Correct, thank you –  megas Feb 6 '13 at 23:42

2 Answers 2

up vote 11 down vote accepted

Well, for all those tcpdump fans =)

RUN ALL THESE COMMANDS AS ROOT !!!

Obtain root in a terminal with sudo -i

sudo -i

To capture the RAW packets ...

sudo tcpdump 'port 80' -w /tmp/http.log &

This will capture all the raw packets and write them to a file, http.log

Run your application. It obviously helps if you do not run any other applications that use http (web browsers)

Kill tcpdump

killall tcpdump

To read the log, use the -A flag and pipe the output to less:

tcpdump -A -r /tmp/http.log | less

The -A flag prints out the "payload" or ascii text in the packets.

This will send the output to less, you can page up and down.

To exit less, type q

When I go to google, I see (in the raw packets) ...

20:42:38.179759 IP ufbt.local.56852 > sea09s02-in-f3.1e100.net.www: Flags [P.], seq 1:587, ack 1, win 913, options [nop,nop,TS val 25523484 ecr 492333202], length 586 E..~.v@.@..q......!#...P.(.gS.c............ ..u..Xh.GET /generate_204 HTTP/1.1

Host: clients1.google.com

Connection: keep-alive

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.34 (KHTML, like Gecko) rekonq Safari/534.34

Referer: http://www.google.com/

Accept: /

Accept-Encoding: gzip, deflate, x-gzip, x-deflate

Accept-Charset: utf-8,*;q=0.5

Accept-Language: en-US, en-US; q=0.8, en; q=0.6

Cookie: PREF=ID=dd958d4544461998:FF=0:TM=1323842648:LM=1360205486:S=Fg_QCDsLMr4ZepIo; NID=67=OQJWjIDHG-B8r4EuM19F3g-nkaMcbvYwoY_CsOjzvYTOAxwqAos5kfzsk6Q14E70gIfJjHat8d8PuQIloB12BE-JuSHgsKHR2QSpgN12qSWoxeqhdcSQgzw5CHKtbR_a

tcpdump has a long set of options to refine data collection from specifying network interfaces to ports to source and destination ip addresses.

It can NOT decrypt (so it will not work with https).

Once you know what you are interested in, you can use a number of options with tcpdump to record only the data of interest.

The general strategy is to first record all the packets, review the raw data, and then capture only the packets of interest.

Some helpful flags (options)

-i Specify an interface
-i eth0

tcp port xx
tcp port 80

dst 1.2.3.4
specify a destination ip address

There is a learning curve, both to using tcpdump and learning how to analyze the data you collect.

For further reading, I highly suggest -

http://danielmiessler.com/study/tcpdump/

share|improve this answer
    
this does not capture anything on my Ubuntu 14.04. My laptop connects to the internet over a wifi router. Would that make a difference to the usage of tcpdump? When i kill it, it just says 0 packets captured 0 packets received by filter 0 packets dropped by kernel But i did open a bunch of sites in the Chrome browser when tcpdump was monitoring. –  faizal Jul 25 at 5:36
    
ahh the linked article helped. tcpdump -i any -w /tmp/http.log & worked. –  faizal Jul 25 at 5:50

I would suggest that you try Wireshark Install Wireshark

Please note that Wireshark is quite advanced, and so may take a bit of getting used to. I have not used it for a few years, but it should still be perfect for what you are after - if not a bit too full of features.

Information about Wireshark and how to use it can be found at the Wireshark homepage.

share|improve this answer
1  
This doesn't work for a single process. You'll get all traffic on the interface and you'll have to filter it by IP/protocol, etc. wireshark - filter by process/pid –  gertvdijk Feb 6 '13 at 23:35
    
yea, but it is easily accomplished with the wireshark interface. –  bodhi.zazen Feb 6 '13 at 23:36
1  
I've tried wireshark before and it's too advanced for me, I'm looking for another option –  megas Feb 6 '13 at 23:36
    
@megas - LOL, there is no easier program. Here is a (basic) tutorial - linuxjournal.com/content/packet-sniffing-basics –  bodhi.zazen Feb 6 '13 at 23:42
3  
The other option is tcpdump. tcpdump is a command line tool, will easily do the job, but has a steeper learning curve. danielmiessler.com/study/tcpdump –  bodhi.zazen Feb 6 '13 at 23:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.