In-depth HTTP traffic analysis using tcpdump & Wireshark

Posted Over 13 years ago. Visible to the public.

From time to time we're convinced that an error must be very close to the network card, OS IP stack or compiler. In reality this is quite rare, so before continuing, triple-check that the issue is not located between chair and keyboard...

If you're still convinced that a in-depth analysis of network traffic might help you, go on:

  • Find out the IP address the client causing trouble will come from.

  • Replace 147.0.0.123 with the client address, log into your web server and run:

    remote$ sudo tcpdump host 147.0.0.123 and port 80 -s 0 -w /tmp/network.dump

  • Copy the dump to your local machine:

    local$ scp $remote_host:/tmp/network.dump .

  • Load the dump:

    local$ wireshark network.dump

Thomas Eisenbarth
Last edit
Over 13 years ago
License
Source code in this card is licensed under the MIT License.
Posted by Thomas Eisenbarth to makandra dev (2011-01-26 13:32)