blocks|key|286814|text|我推荐使用Wireshark，它有一个“跟随TCP+Stream”选项，可以很容易地看到特定TCP连接的完整请求和响应。如果您更喜欢使用命令行，可以尝试使用tcpflow，这是一个专门用于捕获和重建TCP流内容的工具。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|286815|其他选择是使用HTTP调试代理，如EricLaw建议的Charles或Fiddler。它们的优点是具有对HTTP的特定支持，使其更容易处理各种编码，以及保存请求以重放或编辑请求等其他功能。|286816|您还可以使用诸如Firebug+(火狐)、Web+Inspector+(Safari、Chrome和其他基于WebKit的浏览器)或Opera+Dragonfly之类的工具，所有这些工具都提供了一些查看请求和响应头和正文的功能(尽管它们中的大多数不允许您查看确切的字节流，而是浏览器如何解析请求)。|286817|最后，您始终可以手动构造请求，使用telnet、netcat或socat之类的工具连接到端口80并手动键入请求，或者使用htty之类的工具轻松构造请求并检查响应。|286818|entityMap|0|LINK|mutability|MUTABLE|url|http://www.wireshark.org/|1|http://github.com/simsong/tcpflow/|2|http://www.charlesproxy.com/|3|http://www.fiddler2.com/fiddler2/|4|http://getfirebug.com/|5|https://trac.webkit.org/wiki/WebInspector|6|http://www.opera.com/dragonfly/|7|http://netcat.sourceforge.net/|8|http://www.dest-unreach.org/socat/|9|https://github.com/htty/htty^0|5|9|0|26|7|1|0|R|7|2|Z|7|3|0|8|7|4|L|D|5|1U|F|6|0|O|6|7|V|5|8|1O|4|9|0^^$0|@$1|2|3|4|5|6|7|19|8|@]|9|@$A|1A|B|1B|1|1C]|$A|1D|B|1E|1|1F]]|C|$]]|$1|D|3|E|5|6|7|1G|8|@]|9|@$A|1H|B|1I|1|1J]|$A|1K|B|1L|1|1M]]|C|$]]|$1|F|3|G|5|6|7|1N|8|@]|9|@$A|1O|B|1P|1|1Q]|$A|1R|B|1S|1|1T]|$A|1U|B|1V|1|1W]]|C|$]]|$1|H|3|I|5|6|7|1X|8|@]|9|@$A|1Y|B|1Z|1|20]|$A|21|B|22|1|23]|$A|24|B|25|1|26]]|C|$]]|$1|J|3|-4|5|6|7|27|8|@]|9|@]|C|$]]]|K|$L|$5|M|N|O|C|$P|Q]]|R|$5|M|N|O|C|$P|S]]|T|$5|M|N|O|C|$P|U]]|V|$5|M|N|O|C|$P|W]]|X|$5|M|N|O|C|$P|Y]]|Z|$5|M|N|O|C|$P|10]]|11|$5|M|N|O|C|$P|12]]|13|$5|M|N|O|C|$P|14]]|15|$5|M|N|O|C|$P|16]]|17|$5|M|N|O|C|$P|18]]]]

I would recommend using <a href="http://www.wireshark.org/" rel="noreferrer">Wireshark</a>, which has a "Follow TCP Stream" option that makes it very easy to see the full requests and responses for a particular TCP connection. If you would prefer to use the command line, you can try <a href="http://github.com/simsong/tcpflow/" rel="noreferrer">tcpflow</a>, a tool dedicated to capturing and reconstructing the contents of TCP streams.

Other options would be using an HTTP debugging proxy, like <a href="http://www.charlesproxy.com/" rel="noreferrer">Charles</a> or <a href="http://www.fiddler2.com/fiddler2/" rel="noreferrer">Fiddler</a> as EricLaw suggests. These have the advantage of having specific support for HTTP to make it easier to deal with various sorts of encodings, and other features like saving requests to replay them or editing requests. 

You could also use a tool like <a href="http://getfirebug.com/" rel="noreferrer">Firebug</a> (Firefox), <a href="https://trac.webkit.org/wiki/WebInspector" rel="noreferrer">Web Inspector</a> (Safari, Chrome, and other WebKit-based browsers), or <a href="http://www.opera.com/dragonfly/" rel="noreferrer">Opera Dragonfly</a>, all of which provide some ability to view the request and response headers and bodies (though most of them don't allow you to see the exact byte stream, but instead how the browsers parsed the requests). 

And finally, you can always construct requests by hand, using something like telnet, <a href="http://netcat.sourceforge.net/" rel="noreferrer">netcat</a>, or <a href="http://www.dest-unreach.org/socat/" rel="noreferrer">socat</a> to connect to port 80 and type the request in manually, or a tool like <a href="https://github.com/htty/htty" rel="noreferrer">htty</a> to help easily construct a request and inspect the response.

blocks|key|3209073|text|这里有另一个选择：Chaosreader|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3209074|所以我需要调试一个将xml发布到第三方应用程序的应用程序。我发现了一个出色的小perl脚本，它可以完成所有的繁重工作--您只需将其转换为tcpdump输出文件，它就可以执行所有操作并输出您需要的所有内容……|3209075|该脚本名为chaosreader0.94。请参阅http://www.darknet.org.uk/2007/11/chaosreader-trace-tcpudp-sessions-from-tcpdump/|3209076|它就像是一种款待，我做了以下事情：|3209077|tcpdump+host+www.blah.com+-s+9000+-w+outputfile;+perl+chaosreader0.94+outputfile|code-block|syntax|javascript|3209078|entityMap|0|LINK|mutability|MUTABLE|url|http://chaosreader.sourceforge.net/|1|http://www.darknet.org.uk/2007/11/chaosreader-trace-tcpudp-sessions-from-tcpdump/^0|9|B|0|0|0|O|29|1|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@$A|Z|B|10|1|11]]|C|$]]|$1|D|3|E|5|6|7|12|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|13|8|@]|9|@$A|14|B|15|1|16]]|C|$]]|$1|H|3|I|5|6|7|17|8|@]|9|@]|C|$]]|$1|J|3|K|5|L|7|18|8|@]|9|@]|C|$M|N]]|$1|O|3|-4|5|6|7|19|8|@]|9|@]|C|$]]]|P|$Q|$5|R|S|T|C|$U|V]]|W|$5|R|S|T|C|$U|X]]]]

Here is another choice: <a href="http://chaosreader.sourceforge.net/" rel="noreferrer">Chaosreader</a>

So I need to debug an application which posts xml to a 3rd party application. I found a brilliant little perl script which does all the hard work – you just chuck it a tcpdump output file, and it does all the manipulation and outputs everything you need...

The script is called chaosreader0.94. See <a href="http://www.darknet.org.uk/2007/11/chaosreader-trace-tcpudp-sessions-from-tcpdump/" rel="noreferrer">http://www.darknet.org.uk/2007/11/chaosreader-trace-tcpudp-sessions-from-tcpdump/</a>

It worked like a treat, I did the following:

<pre><code>tcpdump host www.blah.com -s 9000 -w outputfile; perl chaosreader0.94 outputfile
</code></pre>

blocks|key|284551|text|HTTP+GET和HTTP+POST+(或两者加上消息正文)都有tcpdump筛选器：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|284552|284553|运行man+tcpdump+%7C+less+-Ip+examples查看一些HTTP+GET的tcpdump过滤器(GET+=+0x47，0x45，0x54，0x20)：|unordered-list-item|offset|length|style|CODE|284554|284555|sudo+tcpdump+-s+0+-A+'tcp[((tcp12:1+&+0xf0)+>>+2):4]+=+0x47455420'|284556|Here’s+HTTP+POST的tcpdump过滤器(POST+=+0x50，0x4f，0x53，0x54)：|284557|284558|sudo+tcpdump+-s+0+-A+'tcp+dst端口80和(tcp[((tcp12:1+&+0xf0)+>>+2):4]+=sudo+tcpdump+HTTP流量，包括请求和响应头以及消息体(source)：|284559|tcpdump+-A+-s+0+'tcp端口80和(ip2:2-+((ip&0xf)<<2))+-((tcp12&0xf0)>>2)+!=+0)‘tcpdump+-X+-s+0+'tcp端口80和(ip2:2-+((ip&0xf)<<2))+-((tcp12&0xf0)>>2)+!=+0)'|284560|有关TCP报头中的位旋转的更多信息，请参见：String-Matching+Capture+Filter+Generator+(指向Sake+Blok的解释的链接)。|284561|entityMap|0|LINK|mutability|MUTABLE|url|https://sites.google.com/site/jimmyxu101/testing/use-tcpdump-to-monitor-http-traffic|1|http://www.wireshark.org/tools/string-cf.html^0|0|0|2|V|1L|3|1R|4|1W|4|21|4|26|4|0|0|0|S|4|Z|4|14|4|19|4|1E|4|0|0|2T|6|0|0|0|M|14|1|0^^$0|@$1|2|3|4|5|6|7|15|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|16|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|17|8|@$F|18|G|19|H|I]|$F|1A|G|1B|H|I]|$F|1C|G|1D|H|I]|$F|1E|G|1F|H|I]|$F|1G|G|1H|H|I]|$F|1I|G|1J|H|I]]|9|@]|A|$]]|$1|J|3|-4|5|6|7|1K|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|1L|8|@]|9|@]|A|$]]|$1|M|3|N|5|E|7|1M|8|@$F|1N|G|1O|H|I]|$F|1P|G|1Q|H|I]|$F|1R|G|1S|H|I]|$F|1T|G|1U|H|I]|$F|1V|G|1W|H|I]]|9|@]|A|$]]|$1|O|3|-4|5|6|7|1X|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|1Y|8|@]|9|@$F|1Z|G|20|1|21]]|A|$]]|$1|R|3|S|5|6|7|22|8|@]|9|@]|A|$]]|$1|T|3|U|5|6|7|23|8|@]|9|@$F|24|G|25|1|26]]|A|$]]|$1|V|3|-4|5|6|7|27|8|@]|9|@]|A|$]]]|W|$X|$5|Y|Z|10|A|$11|12]]|13|$5|Y|Z|10|A|$11|14]]]]

There are tcpdump filters for HTTP GET &amp; HTTP POST (or for both plus message body):

<ul>
<li>Run <code>man tcpdump | less -Ip examples</code> to see some examples</li>
<li>Here’s a tcpdump filter for HTTP GET (<code>GET</code> = <code>0x47</code>, <code>0x45</code>, <code>0x54</code>, <code>0x20</code>):

<pre><code>sudo tcpdump -s 0 -A 'tcp[((tcp[12:1] &amp; 0xf0) &gt;&gt; 2):4] = 0x47455420'
</code></pre></li>
<li>Here’s a tcpdump filter for HTTP POST (<code>POST</code> = <code>0x50</code>, <code>0x4f</code>, <code>0x53</code>, <code>0x54</code>):

<pre><code>sudo tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] &amp; 0xf0) &gt;&gt; 2):4] = 0x504f5354)'
</code></pre></li>
<li>Monitor HTTP traffic including request and response headers and message body (<a href="https://sites.google.com/site/jimmyxu101/testing/use-tcpdump-to-monitor-http-traffic" rel="noreferrer">source</a>):

<pre><code>tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&amp;0xf)&lt;&lt;2)) - ((tcp[12]&amp;0xf0)&gt;&gt;2)) != 0)'
tcpdump -X -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&amp;0xf)&lt;&lt;2)) - ((tcp[12]&amp;0xf0)&gt;&gt;2)) != 0)'
</code></pre></li>
</ul>

For more information on the bit-twiddling in the TCP header see: <a href="http://www.wireshark.org/tools/string-cf.html" rel="noreferrer">String-Matching Capture Filter Generator</a> (link to Sake Blok's explanation).

I am using <code>tcpdump</code> to get HTTP data by executing the below command: 

<pre><code>sudo tcpdump -A -s 1492 dst port 80
</code></pre>

The result of above command: 

<ol>
<li>Headers, I think request and response headers. </li>
<li>Unreadable data. </li>
<li>The url <code>GET /modules/mod_news_pro_gk1/cache/stories.ilbalad.ajayeb.strange-tractor.jpg</code>. </li>
</ol>

I need a more clear result, for example, readable request > response header > response body etc.
How can I filter my results?

Can I use tcpdump to get HTTP requests, response header and response body?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在使用tcpdump通过执行以下命令来获取HTTP数据：sudo tcpdump -A -s 1492 dst port 80上述命令的结果：头，我认为是请求和响应头。不可读数据。 url GET /modules/mod_news_pro_gk1/cache/stories.ilbalad.ajayeb.stra...

问是否可以使用tcpdump获取HTTP请求、响应头和响应体？
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问是否可以使用tcpdump获取HTTP请求、响应头和响应体？EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问是否可以使用tcpdump获取HTTP请求、响应头和响应体？
EN