tcpdump http traffic

tcpdump -c 200000 -w output.pcap -i any

tcpdump -r output.pcap -s 384 -i any -nnq -tttt ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)’ > 80.txt

cut -c 12-21 port80.txt |awk ‘{print $1}’ | sort | uniq -c | awk ‘{print $2 ” ” $1}’ > packets_per_sec.txt

Leave a Reply

Your email address will not be published. Required fields are marked *