Re: TCPDUMP Help needed

[Aravindhan Dhanasekaran <adhanas () ncsu edu>]

On 10/08/2014 07:18 PM, Gaurav Kasliwal wrote:
> I am new to tcpdump. I just want to fetch http url from packets on given
> interface.
> Can you please tell me what command will be useful ?

As far as I know, I don't think you can parse application payload in tcpdump.
Actual tcpdump developers can give you more info on this.

Assuming that's the case, you can :
    1. Write your own code to parse HTTP packets on top of tcpdump.
    2. Write a simple application using libpcap, filter for HTTP packets alone
and do some parsing to get the URLs. Refer to
http://yuba.stanford.edu/~casado/pcap/section1.html for getting started on this.
    3. Use ngrep and Perl/Python scripts to filter the URL text. See
http://ngrep.sourceforge.net/usage.html for more details on this.

/Aravind
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers