我想运行tcpdump与一些参数(仍然不知道什么使用)。然后加载此stackoverflow.com页面。
输出应为HTTP通信。后来我想用它作为一个shell脚本。所以每当我想检查一个网站site.com的HTTP通信，我只能运行script.sh site.com
HTTP通信应该足够简单。如下。
GET /questions/9241391/how-to-capture-all-the-http-communication-data-using-tcp-dump Host: stackoverflow.com ... ... HTTP/1.1 200 OK Cache-Control: public,max-age=60 Content-Length: 35061 Content-Type: text/html; charset=utf-8 Expires: Sat,11 Feb 2012 15:36:46 GMT Last-Modified: Sat,11 Feb 2012 15:35:46 GMT Vary: * Date: Sat,11 Feb 2012 15:35:45 GMT .... decoded deflated data ....
现在，你能告诉我应该使用tcpdump捕获它的选项。
它可以通过ngrep完成
原文链接：https://www.f2er.com/bash/389385.htmlngrep -q -d eth1 -W byline host stackoverflow.com and port 80
^ ^ ^ ^
| | | |
| | | |
| | | v
| | | filter expression
| | |
| | +--> -W is set the dump format ("normal","byline","single","none")
| |
| +----------> -d is use specified device instead of the pcap default
|
+-------------> -q is be quiet ("don't print packet reception hash marks")
