Quote from moshe on 27/10/2020, 10:52 am

Capture HTTP Raw Packets on any network interface and write to log /tmp/http.log

sudo tcpdump -i any -w /tmp/http.log &

monitor HTTP traffic include request and response headers and also message body

tcpdump -A -s 0 ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) – ((tcp[12]&0xf0)>>2)) != 0)’

Destination Port 80

sudo tcpdump dst port 80

Source Port 80

sudo tcpdump dst port 80

Listen HTTP traffic include request and response headers and also message body from a specific source

tcpdump -A -s 0 ‘src tracston.com and tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) – ((tcp[12]&0xf0)>>2)) != 0)’

monitor HTTP traffic include request and response headers and also message body to and from localhost

tcpdump -A -s 0 ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) – ((tcp[12]&0xf0)>>2)) != 0)’ -i lo