Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to get details of my pc's network traffic in details.. i.e. the urls of the uploads and the downloads.. all the network traffic monitors that I tried show the receiving and sending bytes and MBs.. and few show the domain downloading from.. but nothing shows the actual path that I am downloading from.. for example some links are hidden in flash, and they get loaded in the background, and then show.. how to know that link?

Or some flash files I could print to pdf, and it loads the whole file in the browser, then I can print it to pdf.. I want to get that actual link that was downloaded to my pc.. as I can see from the link or view source the swf file, and not the actual file path or url that is loaded..

I am currently using Ubuntu 12.04 (and can use Windows 7 too if that option is not available for Ubuntu).

share|improve this question

migrated from May 10 '12 at 21:25

This question came from our site for professional and enthusiast programmers.

This question is better on Super User; I voted to migrate there. – Mike Pennington May 10 '12 at 2:09

You need to use wireshark

If using wireshark, you need to filter on HTTP GET and POST operations... assuming you spawn tshark (text wireshark) from the CLI:

A very dumb example, all I'm doing is filtering for TCP traffic and grepping for a GET or POST operation... if you want to capture less (and thus use fewer resources), improve the filter to capture less than TCP.

[mpenning@Hotcoffee Models]$ sudo tshark -i eth0 tcp | grep -E "GET|POST"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
 32.282144 ->  HTTP GET HTTP/1.0 
 32.411775 ->  HTTP GET HTTP/1.0 
 44.056340 -> HTTP GET /render/?width=586&height=308&_salt=1336597549.993&target=pctcore_pctlab_local.snmp.if_octets.vlan.rx&target=pctcore_pctlab_local.snmp.if_octets.vlan.tx&from=-12hours HTTP/1.1

The ethernet address of my machine is Note that is not at; that is the address of my HTTP proxy.

There are a lot of knobs in wireshark, some have to do with which ports are considered valid HTTP ports. If you have applications that perform HTTP downloads on unusual TCP ports, you may need to adjust wireshark to interpret this traffic as HTTP.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .