3

I have a database communicating on port 7474 via HTTP (sigh), and I want to debug the queries sent to / from it. However, a filter such as 

http.request.method == "POST"

Filters out every post message sent to other ports.

Originally, I thought that the filtering syntax is shared in tcpdump and Wireshark, but it doesn't matter to me which tool to use, as long as it works :)

Improve this question
4
  • I'm not sure tcpdump's capture filters parse HTTP at all. If you're asking about Wireshark/tshark's read filters, that's a somewhat different thing.
    – u1686_grawity
    Oct 3, 2013 at 14:06
  • @grawity Umm... I thought they were the same :) Well, Wireshark then, that's what I'm using. But if there's some way to do this via tcpdump, that's fine too, whichever gets me there.
    – wvxvw
    Oct 3, 2013 at 14:12
  • There are two places where filtering happens, and they have different syntaxes – "capture filter" (the same in both Wireshark and tcpdump) determines what gets captured at all, and "read filter" (only in Wireshark) determines what gets shown when browsing an existing or running capture.
    – u1686_grawity
    Oct 3, 2013 at 14:15
  • @grawity well, tcpdump can check for particular byte values so maybe it can in theory check if http request is a POST, even if tcpdump doesn't have 'HTTP related keywords' in its 'instruction set'.
    – barlop
    Oct 3, 2013 at 14:24

2 Answers 2

Reset to default
3

Since the connection isn't using any of the standard HTTP ports, you will have to tell Wireshark manually to dissect it as HTTP.

Right-click on any packet sent to port 7474, select "Decode As", then choose "Destination (→7474)" in the Transport tab. Select HTTP in the protocol list.

Improve this answer
1
  • Yup, your answer combined with @nik filter did the trick. Thanks a bunch!
    – wvxvw
    Oct 3, 2013 at 14:44
5

You need to add in the TCP Port filter,

tcp.dstport == 7474 and http.request.method == "POST"

more at the wireshark manual page.

Improve this answer
6
  • -1 his subject says tcpdump. If he wants other than tcpdump(as his comment suggests) then you or he or somebody, should correct the subject. But writing an answer that doesn't match the subject seems like a bad answer to me.
    – barlop
    Oct 3, 2013 at 14:17
  • Nope, this didn't do it. Sorry.
    – wvxvw
    Oct 3, 2013 at 14:17
  • @barlop, OP has already tagged the question wireshark.
    – nik
    Oct 3, 2013 at 14:19
  • @nik ok and subject ok now too, -1 removed.
    – barlop
    Oct 3, 2013 at 14:19
  • @wxvw, Can you please tell us what you do get with this filter? It is supposed to filter all POST packets to the TCP Destination Port 7474. If you have a specific destination IP address at hands, that can be added in too -- and ip.dst == a.b.c.d, see the manual link.
    – nik
    Oct 3, 2013 at 14:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .