2

I need to capture both the post data and the time the request was made. I want to use it to replay requests on the lab server.

When I run the following command:

tcpdump -i any -s 0 -A '(tcp dst port 8100) and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

I get this on screen which is what I want. It includes the the time, URL and the post data:

01:20:02.447094 IP webapps.48086 > webapps.amiganetfs: Flags [P.], seq 3886347649:3886347861, ack 4225527091, win 342, options [nop,nop,TS val 2103470568 ecr 2103470568], length 212
E.....@[email protected].....
}`i.}`i.POST /socket?user=test HTTP/1.1
Host: 192.168.150.156:8100
User-Agent: curl/7.61.1
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=ISO-8859-1
Content-Length: 28

<sample schemaVersion="1"/>

I run the following command to write to file:

tcpdump -i any -s 0 -A '(tcp dst port 8100) and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)' -w network_capture_$(date +"%Y%m%d_%H%M").pcapng -Z root -C 100

When I open it with vim, the time is no longer there and there are lot of non-printable:

}Gò@}Gò?POST /socket?user=test HTTP/1.1^M
Host: 192.168.150.156:8100^M
User-Agent: curl/7.61.1^M
Accept: */*^M
Content-Type: application/x-www-form-urlencoded; charset=ISO-8859-1^M
Content-Length: 28^M
^M
<sample schemaVersion="1"/>ÒY^\dS=^C^@^X^A^@^@^X^A^@^@^@^@^C^D^@^F^@^@^@^@^@^@^@^@^H^@E^@^A^Hï°@^@@^FÄá¬^R<96><9c>¬^R<96><9c>ã¶^H4(<86>        î<9b>Åwn<80>^X^AV<86>X^@^@^A^A^H

I tried removing the non-printable characters with sed $'s/[^[:print:]\t]//g' network_capture_20230324_0053.pcapng but there is still junk after the post data (?YdE]@@W????40ׂ+??VX):

}G??}G??POST /socket?user=test HTTP/1.1
Host: 192.168.150.156:8100
User-Agent: curl/7.61.1
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=ISO-8859-1
Content-Length: 28

<sample schemaVersion="1"/>?YdE]@@W????40ׂ+??VX

How can I get the time, URL and post data to file?

1
  • .pcapng isn't a text file. Does adding --print to the write line produce more useful output? Mar 23, 2023 at 15:08

1 Answer 1

0

To see what tcpdump outputs, read the file with -r, and optionally -A for ascii, like:

tcpdump -A -r filename.pcap

For better interactive formatting and options, use a pcap reader like tcpick

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .