利用tshark从pcap中解析http流量
使用tshark解析
安装tshark
apt install tshark
# 测试
tshark -r gitlab.pcap -T fields -Y http -e tcp.stream -e http.request.method -e http.request.uri -e http.request.version -e http.request.line -e http.response.version -e http.response.code -e http.response.phrase -e http.response.line -e http.file_data
工具
简易脚本pcap2http.sh
需要安装apt install xmlstarlet gawk
#!/bin/bash
FIELDS=(tcp.streamhttp.request.method http.request.uri http.request.versionhttp.request.linehttp.response.version http.response.code http.response.phrasehttp.response.linehttp.file_data
)
tshark -r $1 -T fields -Y http ${FIELDS[@]/#/-e$IFS} |awk -v FS=$'\t' '
{output = $1 ".http";n = $2 ? 2 : 6if (OUTPUTS[output]) printf("") >> output;else {printf("") > output; OUTPUTS[output] = 1; }printf("%s %s %s\n", $n, $(n+1), $(n+2)) >> output;printf("%s\n", gensub("(\\\\r\\\\n,?)+", "\n", "g", $(n+3))) >> output;if (substr($10,1,1) == "<") {fflush(output);close(output);xmlstarlet = "xmlstarlet fo - >> "output;printf("%s\n", gensub("\\\\n", "\n", "g", $10)) | xmlstarlet;close(xmlstarlet);printf("") >> output;}elseprintf("%s\n", $10) >> output;printf("\n--\n\n") >> output;close(output);
}
'
使用方法
./pcap2http.sh xxx.pcap