Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to use netcat as a proxy to log http requests and responses to files, then tail these to inspect traffic. Think wireshark.

Tried the following where 'fifo' is a named pipe, 'in' and 'out' are files, netcat proxy on port 8080, server on port 8081.

while true; do cat fifo | nc -l -p 8080 | tee -a in | nc localhost 8081 | tee -a out 1>fifo; done

Problems:

  • Netcat stop responing after first request (while loop ignored?).

  • Netcat fails with msg localhost [127.0.0.1] 8081 (tproxy) : Connection refused if server unavailable on 8081. Question: Is it possible to "lazily" connect to 8081 when request is made? I.e. I do not want to have 8081 running when netcat is started.

share|improve this question

3 Answers 3

Use socat, you don't need the pipes and fifos

share|improve this answer
    
Works good. Im able to see the response now. But how do I make socat stay alive for subsequent requests? Tried while true; do socat -v tcp-listen:8080,keepalive=1 tcp:localhost:8081; done and socat -v tcp-listen:8080,keepalive=1 tcp:localhost:8081 –  deephacks Oct 6 '12 at 17:40
    
Try fork as in socat -v tcp-listen:8080,fork tcp:localhost:8081 –  RedGrittyBrick Oct 7 '12 at 9:56

I'd use tcpdump (tutorial) for this. I think the command you want would look like this:

sudo tcpdump -i eth0 -s0 -v port 8080
share|improve this answer
    
tcpdump only show raw packets which are hard to read. tcpflow does exactly what I want and eliminate the need to proxy request/response. sudo tcpflow -p -i lo -c port 8081 –  deephacks Oct 6 '12 at 21:23

ncat can do this quite easily, using the --sh-exec argument.

The following command will allow you to see both directions of a TCP connection live, and allows multiple connections. The connection to example.com is done once for each connection received on localhost:8080.

ncat -lkv localhost 8080 -c 'tee /dev/stderr | ncat -v example.com 80 | tee /dev/stderr'

Change the two tee commands to tee -a ./file if you wish to log to a file instead of displaying it live. You can also remove the -v to disable verbose output, leaving just the transfered data printed to the terminal.

-k, --keep-open            Accept multiple connections in listen mode
-l, --listen               Bind and listen for incoming connections
-v, --verbose              Set verbosity level (can be used several times)
-c, --sh-exec <command>    Executes the given command via /bin/sh

See ncat --help or man ncat for more details.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.