have tcpdump mostra a 'conversação' como eu obteria de wireshark?

Question

É possível obter a mesma saída da qual eu obteria:

tcpdump port 80 -w log.pcap
wireshark log.pcap

em wireshark Analyze > Follow TCP Stream e, em seguida, na parte inferior, desça Entire Conversation

mas sem usar o wireshark? O ideal é usar o tcpdump ou outra ferramenta amplamente disponível (netcat?) no console.

    

Answer 1

Versões mais recentes do TShark devem suportar "-z follow" para isso:

   −z follow,prot,mode,filter[,range]
       Displays the contents of a TCP or UDP stream between two nodes.
       The data sent by the second node is prefixed with a tab to
       differentiate it from the data sent by the first node.

       prot specifies the transport protocol.  It can be one of:
           tcp   TCP
           udp   UDP
           ssl   SSL

       mode specifies the output mode.  It can be one of:
           ascii ASCII output with dots for non‐printable characters
           hex   Hexadecimal and ASCII data with offsets
           raw   Hexadecimal data

       Since the output in ascii mode may contain newlines, the length
       of each section of output plus a newline precedes each section
       of output.

       filter specifies the stream to be displayed.  UDP streams are
       selected with IP address plus port pairs.  TCP streams are
       selected with either the stream index or IP address plus port
       pairs.  For example:
           ip−addr0:port0,ip−addr1:port1
           tcp‐stream‐index

       range optionally specifies which "chunks" of the stream should
       be displayed.

       Example: −z "follow,tcp,hex,1" will display the contents of the
       first TCP stream in "hex" format.

     ===================================================================
     Follow: tcp,hex
     Filter: tcp.stream eq 1
     Node 0: 200.57.7.197:32891
     Node 1: 200.57.7.198:2906
     00000000  00 00 00 22 00 00 00 07  00 0a 85 02 07 e9 00 02  ...".... ........
     00000010  07 e9 06 0f 00 0d 00 04  00 00 00 01 00 03 00 06  ........ ........
     00000020  1f 00 06 04 00 00                     ......
         00000000  00 01 00 00                   ....
         00000026  00 02 00 00

       Example: −z
       "follow,tcp,ascii,200.57.7.197:32891,200.57.7.198:2906" will
       display the contents of a TCP stream between 200.57.7.197 port
       32891 and 200.57.7.98 port 2906.

     ===================================================================
     Follow: tcp,ascii
     Filter: (ommitted for readability)
     Node 0: 200.57.7.197:32891
     Node 1: 200.57.7.198:2906
     38
     ...".....
     ................
         4
         ....

Portanto, embora o tcpdump não possa fazer isso por você, versões mais recentes do TShark podem fazê-lo, e o TShark é um programa tty-mode (o que os jovens chamam de "modo de console" :-)).