Capture an Incoming HTTP Request with tcpdump

less than 1 minute read

Capture an Incoming HTTP Request with `tcpdump`

servera  ─── HTTP request ───►  serverb
          ...

servera sends an HTTP request periodically to serverb. There may be no web server listening on serverb.

On serverb:

tcpdump -i any -nn host <servera_IP>

Look for something like:

servera.45000 > serverb.8080: Flags [S]

This means servera tries to connect to TCP/8080.

Without a listener, TCP cannot establish a connection and the HTTP request may never be sent.

ncat -lk 8080

If needed, allow the port:

firewall-cmd --add-port=8080/tcp

In another terminal:

tcpdump -i any -nn -A tcp port 8080

-A displays packet payload as readable ASCII.

Example:

POST / HTTP/1.1
Host: serverb

Secret

On servera:

while true; do
    curl -d 'Secret' http://serverb:8080/
    sleep 60
done

On serverb:

tcpdump -i any -nn host <servera_IP>

Discover the port → start ncat → capture with tcpdump -A.

tcpdump
   ↓
find destination port
   ↓
ncat -lk PORT
   ↓
tcpdump -A
   ↓
read HTTP payload

Key idea: tcpdump shows the traffic, but TCP needs a listening port before the sender can normally transmit the actual HTTP request.