TCPDUMP request and response Header

tcpdump -A -s 10240 ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) – ((tcp[12]&0xf0)>>2)) != 0)’ | egrep –line-buffered “^……..(GET |HTTP\/|POST |HEAD )|^[A-Za-z0-9-]+: ” | sed -r ‘s/^……..(GET |HTTP\/|POST |HEAD )/\n\1/g’

Leave a Reply