View HTTP packet contents with tcpdump

A few quick one-liners to view the contents of HTTP requests and responses, without the need for Wireshark…

HTTP traffic (request/response/body):

tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'

HTTP traffic (request/response/body) from a particular source:

tcpdump -A -s 0 'src HOST.com and tcp port 80 and (((ip[2:2]-((ip[0]&0xf)<<2))-((tcp[12]&0xf0)>>2)) != 0)'

HTTP traffic (request/response/body) from local host to local host:

tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -i lo

Leave a Reply

Your email address will not be published. Required fields are marked *