Development tool: sniff de tráfico

httpry

La tool "httpry" es una herramienta para hacer sniff de tráfico en Linux (Ubuntu) web HTTP (i.e., HTTP requests and responses) o analizar paquetes (packet analyzer) en comunicaciones por interface. Es una alternativa simple de wireshark útil para analizar comunicaciones HTTP, REST y SOAP.

Instalación:

sudo apt-get install git
sudo apt-get install gcc make libpcap0.8-dev
git clone https://github.com/jbittel/httpry.git
cd httpry
make
sudo make install
httpry -h

Usar interface Ethernet:

sudo httpry -i et0

#Todos paquetes tcp por ethernet
sudo httpry -i eth0 'tcp'

Usar interface localhost:

sudo httpry -i lo

#Todos paquetes tcp de todos los puertos de localhost
sudo httpry -i lo 'tcp'

#Para diferentes puertos específicos a la vez
sudo httpry -i lo 'tcp port 80 or 8080 or 8090'

#Uso de expression specify a bpf-style capture filter para muchos puertos
sudo httpry -i lo 'tcp port 80 or 8080 or 8280 or 8290 or 8230 or 8140 or 8320 or 8310 or 8150 or 3307 or 8090'

Usar interface Wireless

sudo httpry -i wlan0 -o dump.txt

Arrojar a un archivo

sudo httpry -i lo -o dump.txt
sudo httpry -i wlan0 -o dump.txt

Ejemplo de una salida

Copyright (c) 2005-2014 Jason Bittel <jason.bittel@gmail.com>
Starting capture on lo interface
2015-05-20 18:05:33.689 127.0.0.1 127.0.0.1 > POST localhost:8080 /Service/soap/srv1 HTTP/1.1 - -
2015-05-20 18:05:33.759 127.0.0.1 127.0.0.1 > POST localhost:8080 /Service/soap/srv2 HTTP/1.1 - -
2015-05-20 18:05:33.785 127.0.0.1 127.0.0.1 > POST localhost:8230 /Service/1.0/soap/srv3 HTTP/1.1 - -
2015-05-20 18:05:34.294 127.0.0.1 127.0.0.1 < - - - HTTP/1.1 200 OK
2015-05-20 18:05:36.026 127.0.0.1 127.0.0.1 > POST localhost:8230 /Service/1.0/soap/srv4 HTTP/1.1 - -
2015-05-20 18:05:36.349 127.0.0.1 127.0.0.1 < - - - HTTP/1.1 200 OK
2015-05-20 18:05:36.355 127.0.0.1 127.0.0.1 < - - - HTTP/1.1 200 OK
2015-05-20 18:05:36.370 127.0.0.1 127.0.0.1 > POST localhost:8230 /Service/1.0/soap/srv5 HTTP/1.1 - -
2015-05-20 18:05:36.700 127.0.0.1 127.0.0.1 < - - - HTTP/1.1 200 OK
2015-05-20 18:05:37.166 127.0.0.1 127.0.0.1 > POST localhost:8090 /Service/1.0/soap/srv6 HTTP/1.1 - -
2015-05-20 18:05:37.573 127.0.0.1 127.0.0.1 < - - - HTTP/1.1 500 Internal Server Error
2015-05-20 18:05:37.584 127.0.0.1 127.0.0.1 > POST localhost:8230 /Service/1.0/soap/srv4 HTTP/1.1 - -
2015-05-20 18:05:37.908 127.0.0.1 127.0.0.1 < - - - HTTP/1.1 200 OK
2015-05-20 18:05:37.918 127.0.0.1 127.0.0.1 < - - - HTTP/1.1 200 OK
...

Filtrar por tipo de HTTP 

Filtrar por GET, POST, PUT, HEAD, CONNECT, etc…:

sudo httpry -i wlan0 -m get,post,head



Referencias:
http://xmodulo.com/sniff-http-traffic-command-line-linux.html
http://manpages.ubuntu.com/manpages/saucy/man1/httpry.1.html
http://dumpsterventures.com/jason/httpry/