Monitor HTTP Packets ( packet sniffing )

How do I monitor and analyze data transferred via HTTP (apache or lighttpd or nginx webserver) for debugging and security purposes?

You can use old good tcpdump program to monitor port 80 (http port) traffic and packets. This can be done over console or remote session via ssh login. If possible, eliminate accesses to the web server other than a test client. Make sure you use port 80 (not port 443 / https ) i.e. the connection must be unencrypted so that the data can be analyzed. Also, note that usernames and passwords are logged in plain text.

Login as a root and type the following command at console:
# tcpdump -n -i {INTERFACE} -s 0 -w {OUTPUT.FILE.NAME} src or dst port 80
# tcpdump -n -i eth1 -s 0 -w output.txt src or dst port 80

Feel free to modify the interface eth1 and file name output.txt according to your setup. Now, you start a web browser and generate traffic. To stop tcpdump press CTRL+C. To examine the finished file output.txt use any text editor. I strongly suggest you import the file (output.txt) into the ethereal program (update: ethereal is renamed as wireshark) where, by right-clicking, it can be displayed in TCP packets (“Follow TCP Stream”) in a reader-friendly form.

Fig.01 – Wireshark in action: Displaying output.txt tcpudum file

See wireshark documentation for further details.

Posted by: SXI ADMIN

The author is the creator of SXI LLC and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.

Leave a Reply

Your email address will not be published. Required fields are marked *

Previous Post

How to Make Website WCAG Compliant?

Next Post

Link download Kali Linux 2020.1 (ISO + Torrent)

Related Posts