Linux – using tcpdump to display XML API requests without headers or ack packets

centos5linuxtcpdump

I need assistance, I am trying to use tcpdump in order to capture API requests and responses between two servers, so far I have the following command:

tcpdump -iany -tpnAXs0 host xxx.xxx.xxx.xxx and port 6666

My problem is, that the output is still hard to read, because it sends the Headers, and the ack packets.

I would like to remove those and only see the XML bodies.

I tried to use grep -v, but apparently this is all one request, so it filters the entire thing…

Thanks!

Best Answer

How about this:

$ while read stream; do \
tshark -qz follow,tcp,ascii,$stream -r soap.pcap; done \
< <(tshark -R "xml" -T fields -e tcp.stream -r soap.pcap | sort | uniq)

Source: http://ask.wireshark.org/questions/18046/extracting-segmented-soap-xml-payload

Related Topic