Simple method to capture HTTP input

Hans Fugal hans at fugal.net
Wed Jan 18 16:18:33 MST 2006


Nope, you should see something like this:
$ ngrep -Wbyline -d any port 80
interface: any
filter: (ip or ip6) and ( port 80 )

T 195.12.191.142:1662 -> 166.70.27.96:80 [AP]
GET /songs/show/139 HTTP/1.1.
Host: lam.fugal.net.
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8)
Gecko/20051111 Firefox/1.5.
Accept:
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5.
Accept-Language: en-us,en;q=0.5.
Accept-Encoding: gzip,deflate.
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7.
Keep-Alive: 300.
Connection: keep-alive.
Referer: http://lam.fugal.net/songs/list.
Cookie: _session_id=ae9f1026df612f278e0831f27ba76a86.
.


T 166.70.27.96:80 -> 195.12.191.142:1662 [A]
HTTP/1.1 200 OK.
Date: Wed, 18 Jan 2006 23:16:34 GMT.
Server: Apache/2.0.54 (Debian GNU/Linux) mod_fastcgi/2.4.2 PHP/5.0.5-3
mod_ruby/1.2.4 Ruby/1.8.2(2005-04-11) mod_ssl/2.0.54 OpenSSL/0.9.7g.
Cache-Control: no-cache.
Set-Cookie: _session_id=ae9f1026df612f278e0831f27ba76a86; path=/.
Keep-Alive: timeout=15, max=100.
Connection: Keep-Alive.
Transfer-Encoding: chunked.
Content-Type: text/html.
.

(a bunch of content)

I'm not sure what the hashes are, but they're not what you're looking
for.

On Wed, 18 Jan 2006 at 11:47 -0700, Al Byers wrote:
> Hans,
> 
> Thanks for your help. I ran ngrep with:
> sudo ngrep -d any port 8081
> 
> when i sent the request from my browser (on same machine) I got a couple 
> of "#" showing and that is all. Does that look like the right syntax?
> 
> -Al
> 
> Hans Fugal wrote:
> 
> >ngrep
> >
> >On Wed, 18 Jan 2006 at 10:55 -0700, Al Byers wrote:
> > 
> >
> >>I would like to  grab the raw http input stream content coming into my 
> >>server from various requests. Is there an easy way to do this? I would 
> >>like to avoid socket programming if I can. The server is running ubuntu 
> >>(breezy). I am comfortable with java and perl. I am generating the 
> >>requests, so I can direct them to any port.
> >>
> >>Thanks,
> >>-Al
> >>
> >>/*
> >>PLUG: http://plug.org, #utah on irc.freenode.net
> >>Unsubscribe: http://plug.org/mailman/options/plug
> >>Don't fear the penguin.
> >>*/
> >>
> >>   
> >>
> >
> > 
> >
> >------------------------------------------------------------------------
> >
> >
> >/*
> >PLUG: http://plug.org, #utah on irc.freenode.net
> >Unsubscribe: http://plug.org/mailman/options/plug
> >Don't fear the penguin.
> >*/
> >
> 
> 
> /*
> PLUG: http://plug.org, #utah on irc.freenode.net
> Unsubscribe: http://plug.org/mailman/options/plug
> Don't fear the penguin.
> */
> 

-- 
Hans Fugal ; http://hans.fugal.net
 
There's nothing remarkable about it. All one has to do is hit the 
right keys at the right time and the instrument plays itself.
    -- Johann Sebastian Bach
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://plug.org/pipermail/plug/attachments/20060118/d9d4913e/attachment.bin 


More information about the PLUG mailing list