Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to get details of my pc's network traffic in details.. i.e. the urls of the uploads and the downloads.. all the network traffic monitors that I tried show the receiving and sending bytes and MBs.. and few show the domain downloading from.. but nothing shows the actual path that I am downloading from.. for example some links are hidden in flash, and they get loaded in the background, and then show.. how to know that link?

Or some flash files I could print to pdf, and it loads the whole file in the browser, then I can print it to pdf.. I want to get that actual link that was downloaded to my pc.. as I can see from the link or view source the swf file, and not the actual file path or url that is loaded..

I am currently using Ubuntu 12.04 (and can use Windows 7 too if that option is not available for Ubuntu).

share|improve this question

migrated from stackoverflow.com May 10 '12 at 21:25

This question came from our site for professional and enthusiast programmers.

    
This question is better on Super User; I voted to migrate there. –  Mike Pennington May 10 '12 at 2:09
add comment

1 Answer

You need to use wireshark

If using wireshark, you need to filter on HTTP GET and POST operations... assuming you spawn tshark (text wireshark) from the CLI:

A very dumb example, all I'm doing is filtering for TCP traffic and grepping for a GET or POST operation... if you want to capture less (and thus use fewer resources), improve the filter to capture less than TCP.

[mpenning@Hotcoffee Models]$ sudo tshark -i eth0 tcp | grep -E "GET|POST"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
 32.282144 172.25.116.10 -> 172.25.0.14  HTTP GET http://cisco.com/ HTTP/1.0 
 32.411775 172.25.116.10 -> 172.25.0.14  HTTP GET http://www.cisco.com/ HTTP/1.0 
 44.056340 172.25.116.10 -> 172.25.116.12 HTTP GET /render/?width=586&height=308&_salt=1336597549.993&target=pctcore_pctlab_local.snmp.if_octets.vlan.rx&target=pctcore_pctlab_local.snmp.if_octets.vlan.tx&from=-12hours HTTP/1.1

The ethernet address of my machine is 172.25.116.10. Note that cisco.com is not at 172.25.0.14; that is the address of my HTTP proxy.

There are a lot of knobs in wireshark, some have to do with which ports are considered valid HTTP ports. If you have applications that perform HTTP downloads on unusual TCP ports, you may need to adjust wireshark to interpret this traffic as HTTP.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.