I need to capture both the post data and the time the request was made. I want to use it to replay requests on the lab server.
When I run the following command:
tcpdump -i any -s 0 -A '(tcp dst port 8100) and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'
I get this on screen which is what I want. It includes the the time, URL and the post data:
01:20:02.447094 IP webapps.48086 > webapps.amiganetfs: Flags [P.], seq 3886347649:3886347861, ack 4225527091, win 342, options [nop,nop,TS val 2103470568 ecr 2103470568], length 212
E.....@[email protected].....
}`i.}`i.POST /socket?user=test HTTP/1.1
Host: 192.168.150.156:8100
User-Agent: curl/7.61.1
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=ISO-8859-1
Content-Length: 28
<sample schemaVersion="1"/>
I run the following command to write to file:
tcpdump -i any -s 0 -A '(tcp dst port 8100) and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)' -w network_capture_$(date +"%Y%m%d_%H%M").pcapng -Z root -C 100
When I open it with vim
, the time is no longer there and there are lot of non-printable:
}Gò@}Gò?POST /socket?user=test HTTP/1.1^M
Host: 192.168.150.156:8100^M
User-Agent: curl/7.61.1^M
Accept: */*^M
Content-Type: application/x-www-form-urlencoded; charset=ISO-8859-1^M
Content-Length: 28^M
^M
<sample schemaVersion="1"/>ÒY^\dS=^C^@^X^A^@^@^X^A^@^@^@^@^C^D^@^F^@^@^@^@^@^@^@^@^H^@E^@^A^Hï°@^@@^FÄá¬^R<96><9c>¬^R<96><9c>ã¶^H4(<86> î<9b>Åwn<80>^X^AV<86>X^@^@^A^A^H
I tried removing the non-printable characters with sed $'s/[^[:print:]\t]//g' network_capture_20230324_0053.pcapng
but there is still junk after the post data (?YdE]@@W????40ׂ+??VX
):
}G??}G??POST /socket?user=test HTTP/1.1
Host: 192.168.150.156:8100
User-Agent: curl/7.61.1
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=ISO-8859-1
Content-Length: 28
<sample schemaVersion="1"/>?YdE]@@W????40ׂ+??VX
How can I get the time, URL and post data to file?
.pcapng
isn't a text file. Does adding--print
to the write line produce more useful output?