Wireshark Command Line HTTP Tutorial

As an administrator or developer working with middleware technologies, you may often encounter situations where you need to capture specific HTTP requests or traffic flows between web servers and application servers. In this tutorial, we will explore how to use Wireshark's command line interface to capture various types of HTTP requests and traffic.

### Capturing Specific HTTP GET Calls

To capture only HTTP GET calls incoming to port 443 (Apache/NGINX), you can use the following command:

```

tshark -i eth0 -Y 'http.request.method == GET and http.server_port == 443'

```

This command tells Wireshark to capture traffic on interface `eth0` and filter the packets based on the HTTP request method being `GET` and the server port being `443`.

### Capturing Specific HTTP POST Requests

To capture only HTTP POST requests incoming to port 80 (Apache/NGINX), you can use the following command:

```

tshark -i eth0 -Y 'http.request.method == POST and http.server_port == 80'

```

This command is similar to the previous one, but it filters packets based on the HTTP request method being `POST` and the server port being `80`.

### Capturing All Incoming HTTP GET Requests

To capture all incoming HTTP GET requests, you can use the following command:

```

tshark -i eth0 -Y 'http.request.method == GET'

```

This command tells Wireshark to capture all packets that contain an HTTP GET request.

### Capturing All Incoming HTTP POST Requests

To capture all incoming HTTP POST requests, you can use the following command:

```

tshark -i eth0 -Y 'http.request.method == POST'

```

This command is similar to the previous one, but it filters packets based on the HTTP request method being `POST`.

### Tracking Incoming Web Service Calls

To track incoming web service calls made using SOAP UI or any other web service client, you can use the following command:

```

tshark -i eth0 -Y 'http.request.method == POST and http.content_type == application/soap+xml'

```

This command tells Wireshark to capture packets that contain an HTTP POST request with a content type of `application/soap+xml`.

### Reviewing Request and Response Data

To review the data being posted to the server in the POST method, such as `content-Type: application/x-www-form-urlencoded`, you can use the following command:

```

tshark -i eth0 -Y 'http.request.method == POST'

```

This command captures all incoming HTTP POST requests and allows you to examine the request and response data.

### Examining Cookies and Headers

To review cookies being placed in the request and response, or to examine the presence and values of specific headers, you can use Wireshark's built-in filtering capabilities. For example:

```

tshark -i eth0 -Y 'http.request.method == GET and http.cookie contains 'cookie_name''

```

This command tells Wireshark to capture packets that contain an HTTP GET request with a cookie containing the value `cookie_name`.

### Tracking Traffic Flow

To track traffic flow between web and application servers, or to monitor the traffic inflow and outflow of Apache httpd server on any specific port like port 80 or 443, you can use Wireshark's command line interface. For example:

```

tshark -i eth0 -Y 'http.server_port == 443'

```

This command captures all packets that contain traffic to or from port `443`.

In conclusion, Wireshark's command line interface provides a powerful tool for capturing and analyzing HTTP requests and traffic flows between web servers and application servers. By using the commands outlined in this tutorial, you can efficiently troubleshoot network issues and gain insights into your system's behavior.

Wireshark command line http tutorial