Linux Tips

How do I capture only specific HTTP traffic to a specific host?

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #10:

Try: sudo tcpdump -i eth0 -w capture.pcap 'host 192.168.1.100 and port 80 and tcp[13] & 2 != 0'

Info: tcpdump captures network packets with BPF filters. This example captures only SYN packets (TCP handshake start) to a specific host on port 80. Perfect for debugging network issues.

Examples:

  • $ sudo tcpdump -i any -n 'port 443 and host github.com'
  • $ sudo tcpdump -i eth0 -A 'tcp port 80'  # Show ASCII payload
  • $ sudo tcpdump -r capture.pcap 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'

Note: Use -w to save and -r to read pcap files. BPF filters: tcp[13] & 2 checks the SYN flag. Open .pcap files in Wireshark for GUI analysis.




LinuxTeck.com 
linuxteck@ubuntu:~$ sudo tcpdump -i eth0 -w capture.pcap 'host 192.168.1.100 and port 80 and tcp[13] & 2 != 0'

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
2500 packets captured
2500 packets received by filter
44 packets dropped by kernel

linuxteck@ubuntu:~$

PREVIOUS ARTICLE Quick Linux Tip #09: How do I see all processes with their container and resource limits? NEXT ARTICLE Quick Linux Tip #11: How do I debug a running process without stopping it?
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.