3 ms·
It's pretty sad, that the best way of analyzing HTTP traffic from the command line appears to be comparing payload bytes: ~$ sudo tcpdump -s 0 -A -vv 'tcp[((
by heinrichhartman 8y ago
It's pretty sad, that the best way of analyzing HTTP traffic from the command line appears to be comparing payload bytes:
~$ sudo tcpdump -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'
There should be a better way to do that. Ideally I would want a tool shows Request Method, Headers, Query String, POST Payload of requests as they come in (and let's me filter on those). It should support HTTP2 and know how to stitch together the payload from multiple packets.
HTTPS is a difficult topic. I think it's fair for a tool like this, not to mess with encrpytion. Usually you don't want to had a precious private key file to a command line tool for debugging. A better way seems to be to terminate SSL on a separate host, and analyze the un-encrypted traffic.
- chatmasta 8y agoLots of tools can do this. I use mitmproxy personally. You can easily customize it by using it as a python library.
- heinrichhartman 8y agoLooks like this requires me to redirect all traffic through a proxy server. This sounds very different from what I want to do. I don't want to change the data path in any way. I just want to listen in.
- chatmasta 8y agoIf you've already terminated SSL, you can do this easily by using iptables nflog rule to duplicate traffic and send it to mitmproxy. Or you can setup a transparent proxy (but sounds like that violates your requirement). Either way, if SSL is not terminated you're not going to be able to do much.