TCPDUMP websites

Get websites being access over the wire.


#!/bin/bash

tcpdump -A -s 10240 ‘tcp port 80 and (((ip[2:2] – ((ip[0]&0xf)<>2)) != 0)’ |

egrep –line-buffered “^……..(GET |HTTP\/|POST |HEAD )|^[A-Za-z0-9-]+: ” |

sed -r ‘s/^……..(GET)/\n\1/g’ |

grep GET