The requirements make this one difficult. A crude solution would be to use tcpdump (or wireshark, if preferred), to examine the network traffic directly:
$ sudo tcpdump -n -tttt -i br0 port 80 -A | grep -A 1 GET
Where br0
is my interface name (a bridge). I don't host multiple sites on that test server, but tested via it's name (s15) and ip address (192.168.111.112). The actual web page is just the default apache web page:
doug@s15:~$ sudo tcpdump -n -tttt -i br0 port 80 -A | grep -A 1 GET
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
2020-02-16 09:11:56.885246 IP 192.168.111.101.62720 > 192.168.111.112.80: Flags [P.], seq 1:481, ack 1, win 1026, length 480: HTTP: GET / HTTP/1.1
E...<.@...[...oe..op...P....J..)P.......GET / HTTP/1.1
Host: 192.168.111.112
--
2020-02-16 09:11:56.997078 IP 192.168.111.101.62720 > 192.168.111.112.80: Flags [P.], seq 481:920, ack 3526, win 1026, length 439: HTTP: GET /icons/ubuntu-logo.png HTTP/1.1
E...<.@...\...oe..op...P....J.$.P...._..GET /icons/ubuntu-logo.png HTTP/1.1
Host: 192.168.111.112
--
2020-02-16 09:12:25.021292 IP 192.168.111.101.62726 > 192.168.111.112.80: Flags [P.], seq 1:469, ack 1, win 8212, length 468: HTTP: GET / HTTP/1.1
E...<.@...[...oe..op...PC.1..L.CP. .H...GET / HTTP/1.1
Host: s15
You mentioned you didn't want to look at the logs, but that would be way easier:
doug@s15:~$ tail /var/log/apache2/access.log
192.168.111.101 - - [16/Feb/2020:09:05:05 -0800] "GET /icons/ubuntu-logo.png HTTP/1.1" 304 180 "http://s15/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:05:20 -0800] "GET / HTTP/1.1" 200 3525 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:05:21 -0800] "GET /icons/ubuntu-logo.png HTTP/1.1" 200 3623 "http://192.168.111.112/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:05:21 -0800] "GET /favicon.ico HTTP/1.1" 404 493 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:06:15 -0800] "GET / HTTP/1.1" 200 3525 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:06:15 -0800] "GET /icons/ubuntu-logo.png HTTP/1.1" 304 180 "http://192.168.111.112/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:11:56 -0800] "GET / HTTP/1.1" 200 3525 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:11:56 -0800] "GET /icons/ubuntu-logo.png HTTP/1.1" 304 180 "http://192.168.111.112/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:12:25 -0800] "GET / HTTP/1.1" 200 3525 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
192.168.111.101 - - [16/Feb/2020:09:12:25 -0800] "GET /icons/ubuntu-logo.png HTTP/1.1" 304 180 "http://s15/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0"
Of course, the simple GET
string filtering the tcpdump output is prone to false triggering on that string being in the returned content.