Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a tracefile and I want to find all web servers that were successfully visited in the trace, contacted via HTTP.

I'm using:

tcpdump -r file.trace - tcp  port 80

Maybe I have to search for a list of server IP that send response packets to me (I mean those that create HTTP sessions with me). Just servers, not other TCP connections. I mean, I need server IPs that answer to HTTP requests and send HTTP responses back.

How could I do that?

share|improve this question

closed as not a real question by Scott, Brad Patton, 8088, Dave M, CharlieRB Apr 19 '13 at 19:50

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
If it's easier to use a GUI, remember that many tools can read these capture files, including Wireshark –  Rich Homolka Apr 17 '13 at 16:13
    
@RichHomolka yes i know that but i need tcpdump. –  Christopher Apr 17 '13 at 16:31
    
I don't understand your remark about removing the hyphen. How is it failing if you take it out? –  tink Apr 17 '13 at 18:23
    
i want to find all web servers that were successfully visited in the trace (that is, contacted via HTTP). Include any servers that engaged in a valid instance of the HTTP protocol, even if the status code returned was, for example, 404 rather than 200. –  Christopher Apr 17 '13 at 20:32
    
The question remains: how is it failing? –  Scott Apr 17 '13 at 21:19

1 Answer 1

up vote 2 down vote accepted
tcpdump -r file.trace - tcp dst port 80

is, as you've discovered, not a valid tcpdump command. If you remove the extra -, then you get

tcpdump -r file.trace tcp dst port 80

which is a valid tcpdump command, that will show you only traffic to TCP port 80. It will not show you traffic from TCP port 80, so, for example, if file.trace has HTTP traffic to and from port 80, it will show you HTTP request traffic but NOT HTTP response traffic.

If you want to see traffic to and from port 80, use

tcpdump -r file.trace tcp port 80

However, if there's TCP traffic other than HTTP traffic to or from port 80, that will also be shown.

In addition, HTTP traffic not going to or from port 80, such as HTTP-over-SSL/TLS ("https") traffic, or traffic to ports such as port 8080, will not be shown. To, for example, see traffic to or from port 80 (for HTTP) and port 443 (for HTTPS), do

tcpdump -r file.trace tcp port 80 or 443

So what's "not working"?

Is it not showing, for example, HTTPS traffic? If so, you need to add port 443.

Is it not showing traffic to other ports? If so, you need to add those ports as well. Tcpdump can't recognize HTTP traffic (and Wireshark only recognizes it by port number).

Is it showing only requests, not responses? If you want to see responses, use tcp port rather than tcp dst port. If you only want to see requests, use tcp dst port.

share|improve this answer
    
tnx for your answer but i want to get list of servers ips that send response packets to me(i mean those that create HTTP sessions with me). i mean just servers not other TCPconnections.how could i done that? –  Christopher Apr 17 '13 at 20:04
    
i mean i need server IPs that answer to http request and send http response back.write this ips in file –  Christopher Apr 17 '13 at 20:20
    
And what's the problem? This has nothing to do with the tcdump command, it's working as designed. Your problem is obviously post-processing the data ... –  tink Apr 18 '13 at 1:01
    
I.e., tcpdump is not designed to show you lists of IP addresses, it's designed to show you dissections of packets. If you want to turn those into lists of IP addresses, you need to process the output of tcpdump, or use some other tool. –  Guy Harris Apr 18 '13 at 1:36
    
@GuyHarris ok well.and how i can detect valid http sessions? –  Christopher Apr 18 '13 at 6:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.