0

I wish to run TCP dump on en0 but only receive matches for GET requests to a certain domain, if not just GET requests would be enough. I have tried this but no luck

Blockquote sudo tcpdump -i en0 -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420’ Blockquote

2
  • Have you tried wireshark? It will be easier to track/filter protocol level info. You can load captured tcpdump files into wireshark if you can't run gui where the capture is.
    – Matt
    Feb 23, 2017 at 1:52
  • I need to add it to a larger script, once it has created the list of GETs i need to tweak them and replay them with curl/wget and save responses to a folder. I could do it with wireshark, but then again I could also do it line by line with other tools - I am trying to automate somewhat Feb 23, 2017 at 10:46

1 Answer 1

0

The bpf filter you're using might actually be correct. It gets the data offset and looks right after it (i.e. the first bytes in the payload of the segment) for "GET" which you have there in ASCII.

I tried your filter and it actually worked... for a very small subset of sites. The majority of traffic is now HTTPS not HTTP so finding raw GET's in the wild is rarer.


Side note: wireshark which was mentioned in the comments is a good thought. Just in case you're not aware, tshark (comes with wireshark) lends itself to automation and can do what you want:

tshark -Y 'http.request.method == GET'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.