Php – Why HTTP sniffers aren’t able to capture PHP generated HTTP traffic

httppacket-snifferPHP

I can't get why HTTP Analyzer (I prefer this one because it is capable of decoding SSL encoded data transfered through HTTPS) isn't able to capture PHP generated HTTP traffic. It capture HTTP traffic of every application except PHP (httpd.exe indeed). It even capture mysql-client's traffic tunneled through HTTP proxy but can't capture plain PHP's HTTP traffic. I tried various HTTP sniffers, but result is always the same. I mean exactly HTTP sniffers, not TCP ones.

Any idea? Is it possible that PHP issues HTTP request in some other way than others do ?

Best Answer

It looks like some issue about not sniffing from the same source.

Different client application? Maybe you are using a client that HTTP analyzer is not connected to/cannot sniff.
Different interface? Maybe you are accessing some service via LAN address (192.168.*) and some other via localhost (127.0.0.1)

Related Solutions

Tool to capture outbound http packets in a linux server

What you need is urlsnarf from the dsniff project. It will generate a log with all http request seen on one network interface. A very good tool !

Capture HTTP GET requests

It does work, make sure you are surrounding your filter in double quotes so the shell doesn't try and parse the filter arguments.

e.g. a curl of google.com for me:

$ sudo tshark -i eth0 "port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
  0.000000   10.53.0.66 -> 209.85.143.104 HTTP GET / HTTP/1.1

This is a rather complicated way of doing it though. tshark does allow you the concept of applying read filters. Now these may not be as useful if you've got a large volume of data (filtering happens after capturing) but they're certainly more intuitive and readable.

$ sudo tshark -i eth0 -R 'http.request.method == "GET"' "port 80"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
  5.641015   10.53.0.66 -> 209.85.143.104 HTTP GET / HTTP/1.1

Best Answer

Related Solutions

Tool to capture outbound http packets in a linux server

Capture HTTP GET requests

Related Topic