无法在 tcpdump 中获取所需的 HTTP 标头
我正在运行基于 Django 的 http 服务器，并尝试使用 tcpdump 收集 HTTP 标头。
这是 tcpdump 命令：
$ sudo tcpdump -i lo0 -s 0 -B 524288 port 8000
这是输出
19:55:55.388635 IP localhost.irdmi > localhost.50558: Flags [P.], seq 126:8318, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
19:55:55.388649 IP localhost.50558 > localhost.irdmi: Flags [.], ack 8318, win 36734, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
19:55:55.388657 IP localhost.irdmi > localhost.50558: Flags [P.], seq 8318:16510, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
19:55:55.388666 IP localhost.50558 > localhost.irdmi: Flags [.], ack 16510, win 32638, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
19:55:55.388673 IP localhost.irdmi > localhost.50558: Flags [P.], seq 16510:24702, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
19:55:55.388682 IP localhost.50558 > localhost.irdmi: Flags [.], ack 24702, win 28542, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
19:55:55.388687 IP localhost.irdmi > localhost.50558: Flags [.], seq 24702:41034, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 16332
19:55:55.388691 IP localhost.irdmi > localhost.50558: Flags [P.], seq 41034:41086, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 52
19:55:55.388707 IP localhost.50558 > localhost.irdmi: Flags [.], ack 41086, win 20350, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
19:55:55.388714 IP localhost.irdmi > localhost.50558: Flags [P.], seq 41086:49278, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
19:55:55.388722 IP localhost.50558 > localhost.irdmi: Flags [.], ack 49278, win 16254, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
19:55:55.388728 IP localhost.irdmi > localhost.50558: Flags [P.], seq 49278:61630, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 12352
19:55:55.388737 IP localhost.50558 > localhost.irdmi: Flags [.], ack 61630, win 10078, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
有人知道这里有什么问题吗？为什么我无法获取请求的完整 HTTP 标头？我尝试使用wireshark，但出现了一些其他错误。
I am running a Django based http server and I am trying to collect the HTTP headers using tcpdump.
Here is the tcpdump command:
$ sudo tcpdump -i lo0 -s 0 -B 524288 port 8000
and here is the output
19:55:55.388635 IP localhost.irdmi > localhost.50558: Flags [P.], seq 126:8318, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
19:55:55.388649 IP localhost.50558 > localhost.irdmi: Flags [.], ack 8318, win 36734, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
19:55:55.388657 IP localhost.irdmi > localhost.50558: Flags [P.], seq 8318:16510, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
19:55:55.388666 IP localhost.50558 > localhost.irdmi: Flags [.], ack 16510, win 32638, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
19:55:55.388673 IP localhost.irdmi > localhost.50558: Flags [P.], seq 16510:24702, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
19:55:55.388682 IP localhost.50558 > localhost.irdmi: Flags [.], ack 24702, win 28542, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
19:55:55.388687 IP localhost.irdmi > localhost.50558: Flags [.], seq 24702:41034, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 16332
19:55:55.388691 IP localhost.irdmi > localhost.50558: Flags [P.], seq 41034:41086, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 52
19:55:55.388707 IP localhost.50558 > localhost.irdmi: Flags [.], ack 41086, win 20350, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
19:55:55.388714 IP localhost.irdmi > localhost.50558: Flags [P.], seq 41086:49278, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 8192
19:55:55.388722 IP localhost.50558 > localhost.irdmi: Flags [.], ack 49278, win 16254, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
19:55:55.388728 IP localhost.irdmi > localhost.50558: Flags [P.], seq 49278:61630, ack 602, win 40830, options [nop,nop,TS val 1192418216 ecr 1192418216], length 12352
19:55:55.388737 IP localhost.50558 > localhost.irdmi: Flags [.], ack 61630, win 10078, options [nop,nop,TS val 1192418216 ecr 1192418216], length 0
Does anybody know what is the problem here? Why cannot I get the full HTTP headers for the request? I tried using wireshark, but I am getting some other errors there.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
下面的命令可以帮助我获取端口
8000上的 http 标头。-s将抓取前 1024 个字节，以便您可以调整以抓取更多或更少的数据包数据。The command below works for me to grab http headers on port
8000. The-swill grab the first 1024 bytes so you can adjust to grab more or less packet data.如果您想查看数据包内容，那么您实际上并不想使用
tcpdump。请改用
tcpflow- 这将显示完整的请求。或者更好的是，使用浏览器扩展（例如 firebug）来查看比数据包嗅探更高级别的标头。要使用 tcpflow 嗅探端口 8000，请使用 tcpflow -c port 8000。它将在标准输出上显示所有流量。
If you want to see packet contents, you don't really want to use
tcpdump.Use
tcpflowinstead - that will show you the full requests. Or even better, use a browser extension such as firebug to view the headers on a much higher level than packet sniffing.To sniff on port 8000 with tcpflow, use
tcpflow -c port 8000. It will display all traffic on stdout.https://github。 com/onotelli/justniffer?tab=readme-ov-file#example-3-capture-all-tcp-traffic
或
https://github.com/onotelli/justniffer?tab=readme-ov-file#example-3-capture-all-tcp-traffic
or