Remove unnecessary characters from tcpdump output

Question

I am using this command to spy on local (macOS) HTTP traffic:

sudo tcpdump -A -s 0 'tcp port 4444 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -i lo0

I works magic but also outputs unnecessary characters:

{"message":"body"}
14:29:07.725362 IP localhost.64258 > localhost.krb524: Flags [P.],seq 1004:1579, ack 469, win 11768, options [nop,nop,TS val 1448865401 ecr 1448865398], length 575 E..s..@.@..............\...^Z.>...-..h.....
V[.yV[.vPOST /v2/8387efc52b0b6b14e83bcd1d1951bdb2 HTTP/1.1
Content-Type: application/json; charset=utf-8

Should be:

{"message":"body"}

POST /v2/8387efc52b0b6b14e83bcd1d1951bdb2 HTTP/1.1
Content-Type: application/json; charset=utf-8

score -1 · Answer 1 · answered Jun 07 '18 at 13:33

Assuming the input you showed :

{"message":"body"}
14:29:07.725362 IP localhost.64258 > localhost.krb524: Flags [P.],seq 1004:1579, ack 469, win 11768, options [nop,nop,TS val 1448865401 ecr 1448865398], length 575 E..s..@.@..............\...^Z.>...-..h.....
V[.yV[.vPOST /v2/8387efc52b0b6b14e83bcd1d1951bdb2 HTTP/1.1
Content-Type: application/json; charset=utf-8

This line of sed :

sed -e 's#^\(.*\)\(\(\(GET\|POST\|PUT\|DELETE\|OPTIONS\)\) /.*$\)#\2#g' input.txt | grep -E '({|Content-Type|GET|POST|PUT|DELETE|OPTIONS)'

Will output this :

{"message":"body"}
POST /v2/8387efc52b0b6b14e83bcd1d1951bdb2 HTTP/1.1
Content-Type: application/json; charset=utf-8

Is this what you need?

Remove unnecessary characters from tcpdump output

1 Answers1