Take the 2-minute tour ×

I want to run tcpdump with some parameters (Still dont know what to use). Then load the this stackoverflow.com page.

Output should be the HTTP communication. Later I want to use it as a shell script. So whenever I want to check the HTTP communicaiton of a site site.com I just can run script.sh site.com

The HTTP communication should be simple enough. Like following.

GET /questions/9241391/how-to-capture-all-the-http-communication-data-using-tcp-dump
Host: stackoverflow.com

HTTP/1.1 200 OK
Cache-Control: public, max-age=60
Content-Length: 35061
Expires: Sat, 11 Feb 2012 15:36:46 GMT
Last-Modified: Sat, 11 Feb 2012 15:35:46 GMT
Vary: *
Date: Sat, 11 Feb 2012 15:35:45 GMT

decoded deflated data

Now, could you tell me which options should I use with tcpdump to capture it.

share|improve this question
add comment

2 Answers

up vote 16 down vote accepted

It can be done by ngrep

ngrep -q -d eth1 -W byline host stackoverflow.com and port 80 
       ^  ^       ^         ^        
       |  |       |         |
       |  |       |         |
       |  |       |         v
       |  |       |         filter expression
       |  |       |         
       |  |       +-->  -W  is set the dump format (normal, byline, single, none)
       |  |
       |  +---------->  -d  is use specified device instead of the pcap default
       +------------->  -q  is be quiet (don't print packet reception hash marks)
share|improve this answer
add comment

Based on what you have mentioned, ngrep (on Unix) and Fiddler (Windows) might be better/easier solutions.

If you absolutely want to use tcpdump, try out the following options

tcpdump -A -vvv host destination_hostname

-A (ascii)
-vvv (verbose output)
share|improve this answer
add comment

Your Answer


