Show HTTP GET requests

Capture and print HTTP GET request lines

tcpdump -i any -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'GET /'
tool
tcpdump18 commands
tags
tcpdumpnetworklinuxdebug

More tcpdump commands

  • Capture between two hosts
    tcpdump -i eth0 'host 10.0.0.1 and host 10.0.0.2'

    BPF filter: traffic between exactly two endpoints

  • Verbose with packet content
    tcpdump -i eth0 -vvv -A -s 0 port 5432

    Full verbose output with ASCII packet content for PostgreSQL

  • Limit capture count
    tcpdump -i eth0 -c 100 -w capture.pcap

    Stop after capturing 100 packets

  • Capture only TCP SYN packets
    tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'

    Catch only connection-initiating SYNs (no SYN-ACK) to spot scans or backlog floods

  • Capture SYN and FIN flags
    tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'

    Show only connection open/close packets to trace short-lived churning sessions

all 18 tcpdump commands