Re: I've got a problem with tcpdump, HELP

2011-04-01 Thread Benimaur Gao
Answer from tcpdump devels: On 1 apr 2011, at 03:49, Benimaur Gao wrote: > The info in this one is quite little!! without request parameter, > without http headers, and even without the essential data return by > the server!! [...] > can anyone give me some clue? > I suspect it is cause by differ

Re: I've got a problem with tcpdump, HELP

2011-03-31 Thread Camaleón
El 2011-04-01 a las 01:02 +0800, Benimaur Gao escribió: (resending to the list) > On Fri, Apr 1, 2011 at 12:49 AM, Camaleón wrote: (...) > > Sure... I also noted the URI was recorded differently. > > > > First one is: > > > > GET > > /misc/ccs/deleteClubThread.html?id=20162669&type=MAINTYPE&op

Re: I've got a problem with tcpdump, HELP

2011-03-31 Thread Camaleón
On Fri, 01 Apr 2011 00:31:20 +0800, Benimaur Gao wrote: (please, avoid using html messages, they're very hard to read) > On Thu, Mar 31, 2011 at 11:54 PM, Camaleón wrote: >> Indeed, the latter output seems to be broken as if had been >> unexpectedly interrupted. How did you manage to stop the ca

Re: I've got a problem with tcpdump, HELP

2011-03-31 Thread Benimaur Gao
Yes, I stop the capture by Ctrl C, but actually, there is no more output.. >;Ts..p..J. >j.B$A...GET /misc/ccs/deleteClubThread ~~ With this request packet, It's also supposed to have more info, such as Content-Type, Date, Set-Cookie, etc. just as the first ca

Re: I've got a problem with tcpdump, HELP

2011-03-31 Thread Camaleón
On Thu, 31 Mar 2011 20:49:03 +0800, Benimaur Gao wrote: > I've encountered a problem in using tcpdump. I tried to capture http > traffic by using the following command: > > # tcpdump -Ani eth1 'host 10.20.156.9 and tcp port 9003 and > (((ip[2:2] - > ((ip[0]&0xf)<<2)) - ((tcp[12]&0