Monitor HTTP Packets ( packet sniffing )

How do I monitor and analyze data transferred via HTTP (apache or lighttpd or nginx webserver) for debugging and security purposes?

You can use old good tcpdump program to monitor port 80 (http port) traffic and packets. This can be done over console or remote session via ssh login. If possible, eliminate accesses to the web server other than a test client. Make sure you use port 80 (not port 443 / https ) i.e. the connection must be unencrypted so that the data can be analyzed. Also, note that usernames and passwords are logged in plain text.

Login as a root and type the following command at console:
# tcpdump -n -i {INTERFACE} -s 0 -w {OUTPUT.FILE.NAME} src or dst port 80
# tcpdump -n -i eth1 -s 0 -w output.txt src or dst port 80

Feel free to modify the interface eth1 and file name output.txt according to your setup. Now, you start a web browser and generate traffic. To stop tcpdump press CTRL+C. To examine the finished file output.txt use any text editor. I strongly suggest you import the file (output.txt) into the ethereal program (update: ethereal is renamed as wireshark) where, by right-clicking, it can be displayed in TCP packets ("Follow TCP Stream") in a reader-friendly form.

Fig.01 - Wireshark in action: Displaying output.txt tcpudum file

See wireshark documentation for further details.

Featured Articles:

• 20 Linux System Monitoring Tools Every SysAdmin Should Know
• My 10 UNIX Command Line Mistakes
• 10 Greatest Open Source Software Of 2009
• Top 5 Email Client For Linux, Mac OS X, and Windows Users
• Top 20 OpenSSH Server Best Security Practices
• Top 10 Open Source Web-Based Project Management Software
• Top 5 Linux Video Editor Software